# Title: Phishing URL Snort2 Ruleset
# Updated: Sat, 23 Jul 2022 00:02:03 +0000
# Expires: 1 day (update frequency)
# Homepage: https://gitlab.com/curben/phishing-filter
# License: https://gitlab.com/curben/phishing-filter#license
# Source: https://www.phishtank.com/ & https://openphish.com/

# Notice: https://curben.gitlab.io/phishing-filter-mirror is moved to https://curben.gitlab.io/malware-filter
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"000-000-0-00000000.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"00000000000000000000.auth-iccu.shesimply.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"000000000000000000000000.aitoloakarnanianews.gr"; content:"Host"; http_header; classtype:attempted-recon; sid:200000003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"004767666634154.litoralsulpremium.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"005spk-id-online.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200000005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"006spk-id-web.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200000006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"008308026233305.kitlanchesisa.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"01-spk-idserv.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200000008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0150tree.xequcevusy.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200000009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"015122625154301.kitlanchesisa.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"016461527143871.kitlanchesisa.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"021034662015959.kitlanchesisa.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"025640258185444.litoralsulpremium.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0293ch.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200000014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0310f955.sibforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"033spk-id-web.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200000016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"035199254017054.kitlanchesisa.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"035508045747058.kitlanchesisa.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"03829gh.byethost3.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"071439966658130.kitlanchesisa.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"077963415308385.kitlanchesisa.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"08863299.sso-secure-mail0454etr.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"09-fdereewdwewweeeeeeeee.ezyro.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0g014rtl96a7i9lmt230oe4lpsbfn4kbp964krtae16i2rnal4t254g.siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0g08brvc40ndulfpk4frqie6k0ojhkc4rsq3unje96sjhksdg93hop8.siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0g08ir6bl3vaf0rgpv8ui1ldtoa3jvma8uh386nm0h0g0b7io3solf0.siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0g0f8kgc3da0fcs1r59e63bio1t5rnlvfvbdr1e9sj8njmnstqfgjp8.siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0pensea.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0range.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0vq4v.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0web.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"0wevsf00wyewpdk.qwo231sdx.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200000032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1000000021205549874416375-pe.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200000033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1000000021205549874416377-pe.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200000034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1000000021205549874416379-pe.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200000035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1000000065465105005647583-pe.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200000036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"104.168.173.244"; content:"Host"; http_header; classtype:attempted-recon; sid:200000037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"104.168.173.248"; content:"Host"; http_header; classtype:attempted-recon; sid:200000038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"109761126210152.kitlanchesisa.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"10e20o30u37.260mb.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1111365.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1111365.vip"; content:"Host"; http_header; classtype:attempted-recon; sid:200000042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1111365585547384.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"11126897531859221.web.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200000044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"11126897531859222.web.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200000045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"11126897531859223.web.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200000046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"11126897531859225.web.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200000047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"11126897531859235.web.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200000048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"11126897531859236.web.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200000049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"114.141.253.232"; content:"Host"; http_header; classtype:attempted-recon; sid:200000050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"12-123movies.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"120901805221826-am.web.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200000052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"121.40.83.145"; content:"Host"; http_header; classtype:attempted-recon; sid:200000053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"121techyard.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"130566135743453.kitlanchesisa.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"134.19.190.72"; content:"Host"; http_header; classtype:attempted-recon; sid:200000056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"142.11.214.173"; content:"Host"; http_header; classtype:attempted-recon; sid:200000057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"143li.trk.elasticemail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"149-210-143-165.colo.transip.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"149.210.143.165"; content:"Host"; http_header; classtype:attempted-recon; sid:200000060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"14gqb.trk.elasticemail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"14jlr.trk.elasticemail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"14l2h.trk.elasticemail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"151sj.trk.elasticemail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"153in.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"154.39.81.91"; content:"Host"; http_header; classtype:attempted-recon; sid:200000066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"154352138047296.kitlanchesisa.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"15alf.trk.elasticemail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"15e92.trk.elasticemail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"15eos.trk.elasticemail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"15fa6.trk.elasticemail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"161.35.142.2"; content:"Host"; http_header; classtype:attempted-recon; sid:200000072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"163-1ew.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"165.227.194.222"; content:"Host"; http_header; classtype:attempted-recon; sid:200000074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"167.71.45.12"; content:"Host"; http_header; classtype:attempted-recon; sid:200000075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"169874.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"175869.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"179.48.65.130"; content:"Host"; http_header; classtype:attempted-recon; sid:200000078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"17jdhukbmz7dyknoxjkzmffnglp.qwo231sdx.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200000079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"180110116028.clickfunnels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"185-186-246-192.cprapid.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"185.186.246.192"; content:"Host"; http_header; classtype:attempted-recon; sid:200000082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"186.64.123.171"; content:"Host"; http_header; classtype:attempted-recon; sid:200000083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"186.75.130.46"; content:"Host"; http_header; classtype:attempted-recon; sid:200000084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"189159383948691.kitlanchesisa.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"190164307211923.litoralsulpremium.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"190854.8b.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200000087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"192.236.178.164"; content:"Host"; http_header; classtype:attempted-recon; sid:200000088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"198.148.100.124"; content:"Host"; http_header; classtype:attempted-recon; sid:200000089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1delivery1-page.765632.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200000090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1en.vashonlove.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1inch-io-stage-app-euc1.s3-website.eu-central-1.amazonaws.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1inch.cfd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1inchcoin.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"1monxt.csb.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"2.136.95.251"; content:"Host"; http_header; classtype:attempted-recon; sid:200000096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"20-213-178-126.cprapid.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"20.121.2.22"; content:"Host"; http_header; classtype:attempted-recon; sid:200000098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"200257ss0aj83j4mo00ekdi643dqpv8le8519v6vh7vkc8pcranning.siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"202.95.6.33"; content:"Host"; http_header; classtype:attempted-recon; sid:200000100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"2022efax0293033393837654hdy367833993.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"208.82.115.230"; content:"Host"; http_header; classtype:attempted-recon; sid:200000102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"210.22.85.94"; content:"Host"; http_header; classtype:attempted-recon; sid:200000103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"213484515571858.kitlanchesisa.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"217522633650121.kitlanchesisa.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"217651.8b.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200000106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"21classical.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"222005982996189.kitlanchesisa.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"23bfbaf9-f1c3-4ba1-9ba0-3777f2083f4f.id.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"24611250.sibforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"246418390440388.kitlanchesisa.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"251.81.74.97.host.secureserver.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"279644420358226.kitlanchesisa.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"2bl.co.rs"; content:"Host"; http_header; classtype:attempted-recon; sid:200000114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"2f6ch-liaaa-aaaad-qdawq-cai.ic.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"2fa.bthei.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"2n.k5wn.cheeseconnoisseur.ca"; content:"Host"; http_header; classtype:attempted-recon; sid:200000117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"2pvmwsiitst.qwo231sdx.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200000118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"2wyslijpaczkeip389184.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200000119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"3004l6eod9e21cl0ub0b0iib82c4bk3f3rj8u4bjefn6gf9fnaimn68.siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"324176392373644.kitlanchesisa.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"327167664591278.litoralsulpremium.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"329290112311967.litoralsulpremium.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"330330369307799.kitlanchesisa.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"343i.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200000125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"345654345.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"34738543833hg5566.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"34839783344hg5566.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"35.192.38.184"; content:"Host"; http_header; classtype:attempted-recon; sid:200000129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"355164467416414.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"355590967640799.kitlanchesisa.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"356629132845372.kitlanchesisa.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"360care-care-doc.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200000133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"360care-care-doc.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200000134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"360care-care-doc.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200000135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"360care-cares-doc.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200000136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"360care-cares-doc.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200000137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"360care-cares-doc.gq"; content:"Host"; http_header; classtype:attempted-recon; sid:200000138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"360care-e-care.gq"; content:"Host"; http_header; classtype:attempted-recon; sid:200000139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"360care-e-care.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200000140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"360care-e-care.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200000141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"360care-i-care.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200000142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"360care-i-care.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200000143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"360care-i-care.gq"; content:"Host"; http_header; classtype:attempted-recon; sid:200000144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"360care-i-care.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200000145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"360care-online-doc.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200000146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"360care-online-doc.gq"; content:"Host"; http_header; classtype:attempted-recon; sid:200000147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"360care-online-docs.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200000148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"360care-online-docs.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200000149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"360care-online-pdf.gq"; content:"Host"; http_header; classtype:attempted-recon; sid:200000150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"360care-online-pdf.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200000151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"360care-online.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200000152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"360care-online.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200000153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"362451041631764.kitlanchesisa.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"36245654.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"363064337086846.litoralsulpremium.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"36774678.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"376959622889450.kitlanchesisa.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"380379326117705.kitlanchesisa.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"397810176400327.kitlanchesisa.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"3a10a178.s6t6sj4s46tu4sys54y5.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"3akubsuge4azhp782pldl5s9i.qwo231sdx.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200000162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"3c5.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"3ceovnll.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"3ff7c459-86b2-4f6d-b6b0-ba6402ef6cb0.htmlcomponentservice.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"3j124.csb.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"3ou.vashonlove.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"40012cs5158niou5te17fermlnqo0q4ks55k3310dshkafnnhi3qdhg.siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"400268u6ar4dg95rktepmukj9fpgmf7g29tprq5lm2nlm31223mdf4o.siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"4002cd2pv7jrlhvgdombn479mkvqodjq3i91qfro3tphu8cku2mlij8.siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"4002k694uqb4grbdicvn14fv9qj6h022ota58sq97mc52bf9gispsag.siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"4004tvo5e7rilfjvglrd8jtt2pqn250dtoobsvlnta9g1mpoctblak0.siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"40058mjbmdcbcbn2vir25ej6t1vulmdj8jpna99sjurm839mek4svag.siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"400cg7k6apu1j8u8mtba58trod1hpjg8ba2ta9rptc1otnn4f5npsd8.siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"400cgpe9ftgophh71dks1uopj54felhbrbg9iv21eagktj8435lmdp8.siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"400cigh31sqa8jpelh9149sfc9ucg16qfuimrjn6hg0p1g6pmhq2mu0.siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"405274750047031.litoralsulpremium.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"407etrhhighway.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"408iksxrthnxo0x4o3pd7dfbf1im.qwo231sdx.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200000179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"415554044109307.litoralsulpremium.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"419gbmuab-d4195.conagopareimbabura.gob.ec"; content:"Host"; http_header; classtype:attempted-recon; sid:200000181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"41h.vashonlove.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"42e2391f.sibforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"43524hh2.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"43isa8iibit1qbabofgtz.qwo231sdx.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200000185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"441528689665750.kitlanchesisa.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"4415514541545.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"45.55.167.181"; content:"Host"; http_header; classtype:attempted-recon; sid:200000188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"452305936938987.kitlanchesisa.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"454145456551546.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"4581jnr8b-d4585.conagopareimbabura.gob.ec"; content:"Host"; http_header; classtype:attempted-recon; sid:200000191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"458237056934236.kitlanchesisa.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"460sbcglobalnet7789sxsrfapqwbukv8qodjfg9y765lcib2dx9mo.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"464470523493722.kitlanchesisa.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"480388229503246.kitlanchesisa.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"483606833500311.litoralsulpremium.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"484859072933237.kitlanchesisa.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"493155305861779.kitlanchesisa.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"495197975330778.kitlanchesisa.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"4br.ir"; content:"Host"; http_header; classtype:attempted-recon; sid:200000200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"4bx28w.csb.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"4e81.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"4g.krgu.cheeseconnoisseur.ca"; content:"Host"; http_header; classtype:attempted-recon; sid:200000203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"4season.com.kh"; content:"Host"; http_header; classtype:attempted-recon; sid:200000204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"4unyu3ve1ms5cnp3rzlge.qwo231sdx.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200000205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"4w8bmmjcw86e.clickfunnels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"4xlxs1.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"51.fi"; content:"Host"; http_header; classtype:attempted-recon; sid:200000208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"52.148.252.166"; content:"Host"; http_header; classtype:attempted-recon; sid:200000209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"52.20.22.249"; content:"Host"; http_header; classtype:attempted-recon; sid:200000210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"5364536625.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200000211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"53vzxcnk6rwp.clickfunnels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"546782d6.sibforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"54876-78546.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200000214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"549wt515b-d5495.conagopareimbabura.gob.ec"; content:"Host"; http_header; classtype:attempted-recon; sid:200000215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"54hl91jm.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200000216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"55smith56ountant2240sbcglobalnetsxsrfapqwbukv8qodjfg9lcib2dx9mo.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"5632d24f-e113-41ab-87a4-59f2061c15e7.id.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"565149002762784.kitlanchesisa.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"569736406392880.kitlanchesisa.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"580655723975080.litoralsulpremium.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"5841589854894638.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200000222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"5apps.vip"; content:"Host"; http_header; classtype:attempted-recon; sid:200000223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"5b0f6cb9-0485-4fc7-9775-eb74bb45bbf6.htmlcomponentservice.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"5e841ae2.srvr-cloudmail-srvr6765e7tg.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"5slkhm4b5.store"; content:"Host"; http_header; classtype:attempted-recon; sid:200000226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"5zym7-5aaaa-aaaad-qb62a-cai.ic.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"61456456044241.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"61da8ae6.6u6566hrrthsh45.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"626525.selcdn.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200000230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"637485579060193.kitlanchesisa.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"638ca12d-ba2f-451c-8418-faf56b7de7ff.htmlcomponentservice.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"6416474165132.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"644591369889227362.mediawebs.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"6464461414456.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"64f2f974.sibforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"651646144164.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"652881884481708.kitlanchesisa.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"65416451444544.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"66466651454055.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"686593970063790.kitlanchesisa.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"69o0r.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"6g006bcoiulqgr5h1helbnq5mdnvtd0qugpcg5tccgbkl8f14hke66g.siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"6g02909buje9judr2g3n22r82tujdksm8b5oao5ovp1stk2t7fcv58g.siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"6g03iq70qk6thpob4ck2i2s366psakroej11r2hfb146638l84tiq9g.siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"6g0577nk513lh11a8l47lrbjfu7d97b2e5ghs3j873q93qpsu300moo.siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"6g06dddgh0becl8muhaco92f5tlhql5ieudiphguqv3bs3gqnpth930.siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"6g0a2me4bfhjo8hgpif45iivmbo1cagot36bijal75rvhttl5mkkhh8.siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"6g0djftjhh0i1q33t86e21735v69qfht3urvtfp22d9i87acpoq8qt0.siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"6kshx.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"6xlxs2.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"705752511468005.kitlanchesisa.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"745b4e1ad89467221.temporary.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200000253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"766320.selcdn.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200000254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"768430.selcdn.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200000255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"770264898274497.kitlanchesisa.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"775674239233187.kitlanchesisa.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"78.108.89.240"; content:"Host"; http_header; classtype:attempted-recon; sid:200000258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"782029066951377.kitlanchesisa.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"788614024650853.kitlanchesisa.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"7c576797.sibforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"7cf3fd69.sibforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"7dbe4fff.sibforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"7fusw1fl.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200000264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"7g0f25kogfmu3iknq8nc5k8ub9ujbalfdjnj860e95sdbmo5t1lb3pg.siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"7nw.vashonlove.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"7wr4u.csb.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"7x5dvh.csb.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"7yu3v.csb.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"80-108-82-166.cable.dynamic.surfer.at"; content:"Host"; http_header; classtype:attempted-recon; sid:200000270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"801shonen.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"810978658604757.kitlanchesisa.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"81e6736a-ae54-43ce-87b9-5fcb4a364af2.id.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"82.223.79.230"; content:"Host"; http_header; classtype:attempted-recon; sid:200000274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"83.212.106.222"; content:"Host"; http_header; classtype:attempted-recon; sid:200000275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"85165109infodataupdate.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200000276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"858zmzpe.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"86tui.pbgnfxaftmuypz.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"873twc.csb.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"89888756.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200000280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"899802516595267.kitlanchesisa.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"8auahx.assertiviadoc.cloud"; content:"Host"; http_header; classtype:attempted-recon; sid:200000282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"8d7af84c.sibforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"8g090lboovq1lheb21ptr4vb7jtqv0k77s6h4o1sc49fcakts0umvcg.siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"8tz.vashonlove.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"9.jvemlbioja6989.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"907471394927219.kitlanchesisa.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"91-234-99-113.cprapid.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"91-234-99-113.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200000289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"91.121.143.96"; content:"Host"; http_header; classtype:attempted-recon; sid:200000290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"91.234.99.113"; content:"Host"; http_header; classtype:attempted-recon; sid:200000291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"916875284003844.kitlanchesisa.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"92.204.144.8"; content:"Host"; http_header; classtype:attempted-recon; sid:200000293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"923022870128489.kitlanchesisa.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"926280141091336.kitlanchesisa.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"931639901891073.kitlanchesisa.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"937690620856900.litoralsulpremium.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"943151c8c3ad.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"949342532747710.kitlanchesisa.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"950180586985644.kitlanchesisa.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"96rod6kw19pjo6v.qwo231sdx.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200000301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"987121934000989.kitlanchesisa.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"999855ez.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"9d62cfee-59b3-42a8-9542-4b3a32692792.htmlcomponentservice.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"9ftytucsh4ph.clickfunnels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"9janewshub.com.ng"; content:"Host"; http_header; classtype:attempted-recon; sid:200000306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"9uss5dj.qwo231sdx.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200000307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"a.60b7ac265566e3da4341f765b2d2a73200f8f1db57b0b005a1afdc00.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"a.dab342ab8887461995aad393cb294948a5ce800ca279cd1027026d47.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"a.eddyx.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"a.insecurpage.recovery-safty.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"a.oubangui-stat.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"a0570626.xsph.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200000313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"a0698311.xsph.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200000314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"a0698947.xsph.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200000315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"a4aptitude.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"a4d3b42c.chgmar-d8y.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"a5faxapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"a71843c1.mailssocloud-srvr65e5rd.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"a7fgt9e8sxadny.qwo231sdx.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200000320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"a894ec7f.46t33454t4.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"a8b.vashonlove.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aa.mfs.gg"; content:"Host"; http_header; classtype:attempted-recon; sid:200000323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aaaa-9qg.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aadesignmalta.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aahsolutions.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aarr.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aav.vashonlove.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aave-airdrop.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aavelend.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aavelp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aawhhsdbvsjbvsdjkbskldhj.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200000332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"abacontact.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"abf.org.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200000334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"abichan.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"abonnement.netflix.com.89-163-221-46.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200000336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"absolutepleasure.com.my"; content:"Host"; http_header; classtype:attempted-recon; sid:200000337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"abusedid.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200000338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"academia-rennersolucoes-portl.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accedi-ora-mps.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accesrewards.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"access-online.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200000342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accessreward.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accman.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200000344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"account-update-info.01gv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"account.qualismais.odo.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"account.verifications.help-page.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accountabillabuddy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accueil-creditagricole-6d650.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"accueil-creditagricole-6d650.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acess-ofici-fatura.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acessando-contassl0.dns.army"; content:"Host"; http_header; classtype:attempted-recon; sid:200000352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acessando-facil-solucoes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acessando-facilmente-solucoes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acesso.tecnomotor.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acessodedodemo.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acessopjcef.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"achulemarecoa.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"achulemarecoa.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aciermetal.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acn.unpbls.sprt-acn.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acnrcvry.kezunlxgra-ewl6n1jmj352.p.runcloud.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200000362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acnscure.cnfrm.scrthlp.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.00jd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.01ov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.03an.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.chongsiling.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.fashions.show"; content:"Host"; http_header; classtype:attempted-recon; sid:200000368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.gangtiemao.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.guochanhua.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.ihetao.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.ijingzhun.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.ijzy.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.ilechun.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.ipangxin.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.ipengyou.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.ippq.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.iscr.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.iwym.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.ixyg.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.iyouqiu.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.izhixin.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.izzd.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.j2n.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.jiazicloud.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.mnft.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200000386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.otzarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.qiyi.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.quanshikong.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.rictwz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.tianzhujiao.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.txiwjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.tzngly.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.uayuxc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.ufwybn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.wetot.asia"; content:"Host"; http_header; classtype:attempted-recon; sid:200000396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.wetot.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.wetot.city"; content:"Host"; http_header; classtype:attempted-recon; sid:200000398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.wetot.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.wetot.kim"; content:"Host"; http_header; classtype:attempted-recon; sid:200000400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.wetot.show"; content:"Host"; http_header; classtype:attempted-recon; sid:200000401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.wnsvnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.xwjimg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.xxbjzt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.yameimei.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.ybtamg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.ycqdte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.yhyyti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.youmeitan.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.yviwho.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.yymowi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.zaweli.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.zenwzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.zetkvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.zgepsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.zhaotata.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.zjnkse.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.znepgh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.znknig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.znqehi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.zstyum.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoeon.zuigongpin.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.00jd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.01ov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.03an.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.chongsiling.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.fashions.show"; content:"Host"; http_header; classtype:attempted-recon; sid:200000427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.footballs.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.gangtiemao.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.guochanhua.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.harford.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.healey.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.healthy-liv.fit"; content:"Host"; http_header; classtype:attempted-recon; sid:200000433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.ihetao.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.iiot.today"; content:"Host"; http_header; classtype:attempted-recon; sid:200000435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.ijingzhun.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.ijzy.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.ilechun.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.ipangxin.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.ipengyou.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.ippq.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.iscr.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.iwym.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.ixyg.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.iyouqiu.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.izhixin.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.izzd.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.j2n.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.jiazicloud.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.keck.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.kinsley.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.mcclure.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.mnft.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200000453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.mobiles.world"; content:"Host"; http_header; classtype:attempted-recon; sid:200000454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.ocular.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.otzarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.pecker.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.pens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.pete.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.ptzh.com.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200000460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.qiyi.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.qrgj.com.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200000462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.quanshikong.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.rictwz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.selfie.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.tianzhujiao.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.txiwjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.tzngly.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.uayuxc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.ufwybn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.wangcaitongbao2.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.wetot.asia"; content:"Host"; http_header; classtype:attempted-recon; sid:200000472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.wetot.beer"; content:"Host"; http_header; classtype:attempted-recon; sid:200000473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.wetot.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200000474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.wetot.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.wetot.center"; content:"Host"; http_header; classtype:attempted-recon; sid:200000476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.wetot.city"; content:"Host"; http_header; classtype:attempted-recon; sid:200000477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.wetot.cloud"; content:"Host"; http_header; classtype:attempted-recon; sid:200000478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.wetot.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.wetot.email"; content:"Host"; http_header; classtype:attempted-recon; sid:200000480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.wetot.kim"; content:"Host"; http_header; classtype:attempted-recon; sid:200000481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.wetot.plus"; content:"Host"; http_header; classtype:attempted-recon; sid:200000482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.wetot.red"; content:"Host"; http_header; classtype:attempted-recon; sid:200000483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.wetot.show"; content:"Host"; http_header; classtype:attempted-recon; sid:200000484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.wetot.today"; content:"Host"; http_header; classtype:attempted-recon; sid:200000485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.wetot.work"; content:"Host"; http_header; classtype:attempted-recon; sid:200000486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.wetot.world"; content:"Host"; http_header; classtype:attempted-recon; sid:200000487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.wnsvnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.xwjimg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.xxbjzt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.yameimei.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.ybtamg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.ycqdte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.yhyyti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.youmeitan.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.yviwho.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.yymowi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.zaweli.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.zenwzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.zetkvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.zgepsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.zhaotata.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.zjnkse.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.znepgh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.znknig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.znqehi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.zstyum.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acocceon.aseocoon.zuigongpin.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.00jd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.01ov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.03an.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.aifrench.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.chongsiling.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.crystals.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.efficiency.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.eshare.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.fashions.show"; content:"Host"; http_header; classtype:attempted-recon; sid:200000517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.footballs.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.gangtiemao.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.guochanhua.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.harford.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.healey.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.healthy-liv.fit"; content:"Host"; http_header; classtype:attempted-recon; sid:200000523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.ihetao.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.iiot.today"; content:"Host"; http_header; classtype:attempted-recon; sid:200000525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.ijingzhun.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.ijzy.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.ilechun.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.ipangxin.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.ipengyou.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.ippq.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.iscr.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.iwym.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.ixyg.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.iyouqiu.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.izhixin.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.izzd.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.j2n.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.jiazicloud.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.keck.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.kinsley.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.mcclure.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.mnft.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200000543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.mobiles.world"; content:"Host"; http_header; classtype:attempted-recon; sid:200000544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.ocular.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.otzarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.pecker.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.pens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.pete.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.ptzh.com.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200000550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.qiyi.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.qrgj.com.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200000552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.quanshikong.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.rictwz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.selfie.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.tianzhujiao.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.txiwjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.tzngly.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.uayuxc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.ufwybn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.wangcaitongbao2.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.wetot.asia"; content:"Host"; http_header; classtype:attempted-recon; sid:200000562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.wetot.beer"; content:"Host"; http_header; classtype:attempted-recon; sid:200000563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.wetot.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200000564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.wetot.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.wetot.center"; content:"Host"; http_header; classtype:attempted-recon; sid:200000566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.wetot.city"; content:"Host"; http_header; classtype:attempted-recon; sid:200000567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.wetot.cloud"; content:"Host"; http_header; classtype:attempted-recon; sid:200000568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.wetot.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.wetot.email"; content:"Host"; http_header; classtype:attempted-recon; sid:200000570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.wetot.kim"; content:"Host"; http_header; classtype:attempted-recon; sid:200000571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.wetot.plus"; content:"Host"; http_header; classtype:attempted-recon; sid:200000572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.wetot.red"; content:"Host"; http_header; classtype:attempted-recon; sid:200000573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.wetot.show"; content:"Host"; http_header; classtype:attempted-recon; sid:200000574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.wetot.today"; content:"Host"; http_header; classtype:attempted-recon; sid:200000575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.wetot.work"; content:"Host"; http_header; classtype:attempted-recon; sid:200000576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.wetot.world"; content:"Host"; http_header; classtype:attempted-recon; sid:200000577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.wnsvnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.xwjimg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.xxbjzt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.yameimei.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.ybtamg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.ycqdte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.yhyyti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.youmeitan.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.yviwho.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.yymowi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.zaweli.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.zenwzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.zetkvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.zgepsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.zhaotata.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.zjnkse.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.znepgh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.znknig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.znqehi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.zstyum.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoceon.aseocon.zuigongpin.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acosoeu-ascaosneouu.rwmcr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acosoeu-ascaosneouu.uvlhwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acosoeu-ascaosneouu.wkbakq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acosoeu-ascaosneouu.wozavw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acosoeu-ascaosneouu.xfertf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acosoeu-ascaosneouu.xovtfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acosoeu-ascaosneouu.xubnkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acosoeu-ascaosneouu.xvotal.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acosoeu-ascaosneouu.yqggww.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acosoeu-ascaosneouu.ytbspo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acosoeu-ascaosneouu.zpirok.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acoustic-clumsy-lute.glitch.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200000610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"act-premco.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200000611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"activate-hulu-com-activate.sitey.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200000612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"activate.segmentwizard.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"activatesynmainnet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"activatiioncode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"actorstores.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200000616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"actualizargeneral.c1.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200000617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acuascut.bluehoststaff.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"acxfbi.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200000619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ad-help.19786543621962.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adamgreenberglcsw.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adcloudserver.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"addonremoval.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ademi.iklient.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adept-producer-5628.ck.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200000625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"admin-formserviceupdates.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"admin.epochfinancialus.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adminboxalerta.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"administranutri.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200000629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adobemicrosoftonline.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adobeofficec5c2e764c17d59ed03ed35f514778e40c5c2e764c17d59ed03ed.officepost1.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200000631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adpunemploymentclaims.sharefile.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adroitjobs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"advancelink.easy.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adveninternational.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adviapage1.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"adzz-100023.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeeosn.aseosocn.jaubvr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeeosn.aseosocn.jeiupo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeeosn.aseosocn.jtaykj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeeosn.aseosocn.juocax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeeosn.aseosocn.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeeosn.aseosocn.luhbim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeeosn.aseosocn.lxqslk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeeosn.aseosocn.manljw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeeosn.aseosocn.mwhjux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeeosn.aseosocn.nytsha.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeeosn.aseosocn.ovbfsv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeeosn.aseosocn.pdmvfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeeosn.aseosocn.pheudi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeeosn.aseosocn.rabbhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aegroup-0utlook-datastorage.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aegroup-0utlook-datastorage.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200000653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeon-co-jp-dc4b036f022.atinoflgura.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200000654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeon-co-jp-dc4b036f022.atinoflgurb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200000655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeon-co-jp-dc4b036f022.atinoflgurc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200000656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeon-co-jp-dc4b036f022.atinoflgurd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200000657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeon-co-jp-dc4b036f022.atinoflgure.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200000658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeon.co-jp.1230351.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoseno.aessoeon.jaubvr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoseno.aessoeon.jcxaec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoseno.aessoeon.jeiupo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoseno.aessoeon.kwoneq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoseno.aessoeon.lioimy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoseno.aessoeon.lnkmoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoseno.aessoeon.manljw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoseno.aessoeon.mltuey.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoseno.aessoeon.nmlubc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoseno.aessoeon.okpufh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoseno.aessoeon.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoseno.aessoeon.owkcmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoseno.aessoeon.pheudi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeoseno.aessoeon.rbtuib.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeosocemosn.amsoemsn.ivupqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeosocemosn.amsoemsn.jcxaec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeosocemosn.amsoemsn.jeiupo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeosocemosn.amsoemsn.jpjxxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeosocemosn.amsoemsn.jxvstx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeosocemosn.amsoemsn.kwoneq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeosocemosn.amsoemsn.kzadys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeosocemosn.amsoemsn.lioimy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeosocemosn.amsoemsn.meqery.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeosocemosn.amsoemsn.mltuey.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeosocemosn.amsoemsn.nytsha.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeosocemosn.amsoemsn.owkcmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeosocemosn.amsoemsn.ozicyo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeosocemosn.amsoemsn.pdmvfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeosocemosn.amsoemsn.pwzivx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aeosocemosn.amsoemsn.rabbhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aerospacesses.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200000690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.00jd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.01ov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.03an.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.aifrench.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.chongsiling.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.crystals.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.efficiency.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.eshare.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.fashions.show"; content:"Host"; http_header; classtype:attempted-recon; sid:200000699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.footballs.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.gangtiemao.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.guochanhua.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.harford.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.healey.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.healthy-liv.fit"; content:"Host"; http_header; classtype:attempted-recon; sid:200000705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.ihetao.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.iiot.today"; content:"Host"; http_header; classtype:attempted-recon; sid:200000707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.ijingzhun.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.ijzy.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.ilechun.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.ipangxin.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.ipengyou.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.ippq.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.iscr.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.iwym.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.ixyg.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.iyouqiu.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.izhixin.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.izzd.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.j2n.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.jiazicloud.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.keck.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.kinsley.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.mcclure.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.mnft.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200000725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.mobiles.world"; content:"Host"; http_header; classtype:attempted-recon; sid:200000726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.ocular.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.otzarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.pecker.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.pens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.pete.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.ptzh.com.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200000732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.qiyi.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.qrgj.com.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200000734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.quanshikong.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.rictwz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.selfie.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.tianzhujiao.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.txiwjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.tzngly.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.uayuxc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.ufwybn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.wangcaitongbao2.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.wetot.asia"; content:"Host"; http_header; classtype:attempted-recon; sid:200000744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.wetot.beer"; content:"Host"; http_header; classtype:attempted-recon; sid:200000745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.wetot.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200000746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.wetot.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.wetot.center"; content:"Host"; http_header; classtype:attempted-recon; sid:200000748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.wetot.city"; content:"Host"; http_header; classtype:attempted-recon; sid:200000749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.wetot.cloud"; content:"Host"; http_header; classtype:attempted-recon; sid:200000750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.wetot.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.wetot.email"; content:"Host"; http_header; classtype:attempted-recon; sid:200000752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.wetot.kim"; content:"Host"; http_header; classtype:attempted-recon; sid:200000753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.wetot.plus"; content:"Host"; http_header; classtype:attempted-recon; sid:200000754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.wetot.red"; content:"Host"; http_header; classtype:attempted-recon; sid:200000755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.wetot.show"; content:"Host"; http_header; classtype:attempted-recon; sid:200000756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.wetot.today"; content:"Host"; http_header; classtype:attempted-recon; sid:200000757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.wetot.work"; content:"Host"; http_header; classtype:attempted-recon; sid:200000758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.wetot.world"; content:"Host"; http_header; classtype:attempted-recon; sid:200000759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.wnsvnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.xwjimg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.xxbjzt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.yameimei.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.ybtamg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.ycqdte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.yhyyti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.youmeitan.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.yviwho.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.yymowi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.zaweli.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.zenwzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.zetkvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.zgepsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.zhaotata.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.zjnkse.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.znepgh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.znknig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.znqehi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.zstyum.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescoen.asecosoone.zuigongpin.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.00jd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.01ov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.03an.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.aifrench.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.chongsiling.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.crystals.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.efficiency.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.eshare.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.fashions.show"; content:"Host"; http_header; classtype:attempted-recon; sid:200000789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.footballs.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.gangtiemao.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.guochanhua.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.harford.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.healey.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.healthy-liv.fit"; content:"Host"; http_header; classtype:attempted-recon; sid:200000795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.ihetao.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.iiot.today"; content:"Host"; http_header; classtype:attempted-recon; sid:200000797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.ijingzhun.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.ijzy.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.ilechun.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.ipangxin.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.ipengyou.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.ippq.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.iscr.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.iwym.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.ixyg.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.iyouqiu.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.izhixin.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.izzd.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.j2n.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.keck.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.kinsley.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.mcclure.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.mnft.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200000814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.mobiles.world"; content:"Host"; http_header; classtype:attempted-recon; sid:200000815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.ocular.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.otzarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.pecker.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.pens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.pete.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.ptzh.com.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200000821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.qiyi.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.qrgj.com.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200000823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.quanshikong.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.rictwz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.selfie.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.tianzhujiao.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.txiwjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.tzngly.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.uayuxc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.ufwybn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.wangcaitongbao2.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.wetot.asia"; content:"Host"; http_header; classtype:attempted-recon; sid:200000833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.wetot.beer"; content:"Host"; http_header; classtype:attempted-recon; sid:200000834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.wetot.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200000835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.wetot.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.wetot.center"; content:"Host"; http_header; classtype:attempted-recon; sid:200000837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.wetot.city"; content:"Host"; http_header; classtype:attempted-recon; sid:200000838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.wetot.cloud"; content:"Host"; http_header; classtype:attempted-recon; sid:200000839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.wetot.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.wetot.email"; content:"Host"; http_header; classtype:attempted-recon; sid:200000841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.wetot.kim"; content:"Host"; http_header; classtype:attempted-recon; sid:200000842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.wetot.plus"; content:"Host"; http_header; classtype:attempted-recon; sid:200000843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.wetot.red"; content:"Host"; http_header; classtype:attempted-recon; sid:200000844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.wetot.show"; content:"Host"; http_header; classtype:attempted-recon; sid:200000845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.wetot.today"; content:"Host"; http_header; classtype:attempted-recon; sid:200000846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.wetot.work"; content:"Host"; http_header; classtype:attempted-recon; sid:200000847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.wetot.world"; content:"Host"; http_header; classtype:attempted-recon; sid:200000848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.wnsvnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.xwjimg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.xxbjzt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.yameimei.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.ybtamg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.ycqdte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.yhyyti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.youmeitan.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.yviwho.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.yymowi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.zaweli.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.zenwzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.zetkvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.zgepsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.zhaotata.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.zjnkse.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.znepgh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.znknig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.znqehi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.zstyum.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aescosn.aoeescocone.zuigongpin.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.00jd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.01ov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.03an.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.aifrench.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.chongsiling.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.crystals.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.efficiency.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.eshare.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.fashions.show"; content:"Host"; http_header; classtype:attempted-recon; sid:200000878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.footballs.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.gangtiemao.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.guochanhua.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.harford.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.healey.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.healthy-liv.fit"; content:"Host"; http_header; classtype:attempted-recon; sid:200000884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.ihetao.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.iiot.today"; content:"Host"; http_header; classtype:attempted-recon; sid:200000886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.ijingzhun.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.ijzy.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.ilechun.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.ipangxin.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.ipengyou.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.ippq.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.iscr.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.iwym.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.ixyg.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.iyouqiu.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.izhixin.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.izzd.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.j2n.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.jiazicloud.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.keck.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.kinsley.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.mcclure.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.mnft.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200000904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.mobiles.world"; content:"Host"; http_header; classtype:attempted-recon; sid:200000905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.ocular.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.otzarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.pecker.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.pens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.pete.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.ptzh.com.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200000911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.qiyi.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.qrgj.com.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200000913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.quanshikong.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.rictwz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.selfie.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.tianzhujiao.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.txiwjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.tzngly.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.uayuxc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.ufwybn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.wangcaitongbao2.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.wetot.asia"; content:"Host"; http_header; classtype:attempted-recon; sid:200000923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.wetot.beer"; content:"Host"; http_header; classtype:attempted-recon; sid:200000924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.wetot.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200000925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.wetot.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.wetot.center"; content:"Host"; http_header; classtype:attempted-recon; sid:200000927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.wetot.city"; content:"Host"; http_header; classtype:attempted-recon; sid:200000928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.wetot.cloud"; content:"Host"; http_header; classtype:attempted-recon; sid:200000929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.wetot.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200000930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.wetot.email"; content:"Host"; http_header; classtype:attempted-recon; sid:200000931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.wetot.kim"; content:"Host"; http_header; classtype:attempted-recon; sid:200000932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.wetot.plus"; content:"Host"; http_header; classtype:attempted-recon; sid:200000933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.wetot.red"; content:"Host"; http_header; classtype:attempted-recon; sid:200000934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.wetot.show"; content:"Host"; http_header; classtype:attempted-recon; sid:200000935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.wetot.today"; content:"Host"; http_header; classtype:attempted-recon; sid:200000936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.wetot.work"; content:"Host"; http_header; classtype:attempted-recon; sid:200000937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.wetot.world"; content:"Host"; http_header; classtype:attempted-recon; sid:200000938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.wnsvnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.xwjimg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.xxbjzt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.yameimei.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.ybtamg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.ycqdte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.yhyyti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.youmeitan.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.yviwho.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.yymowi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.zaweli.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.zenwzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.zetkvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.zgepsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.zhaotata.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.zjnkse.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.znepgh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.znknig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.znqehi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.zstyum.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocen.asecosoeone.zuigongpin.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.00jd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.01ov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.03an.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.aifrench.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200000963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.chongsiling.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.crystals.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.efficiency.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.eshare.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.fashions.show"; content:"Host"; http_header; classtype:attempted-recon; sid:200000968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.footballs.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.gangtiemao.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.guochanhua.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.harford.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.healey.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.healthy-liv.fit"; content:"Host"; http_header; classtype:attempted-recon; sid:200000974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.ihetao.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.iiot.today"; content:"Host"; http_header; classtype:attempted-recon; sid:200000976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.ijingzhun.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.ijzy.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.ilechun.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.ipangxin.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.ipengyou.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.ippq.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.iscr.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.iwym.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.ixyg.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.iyouqiu.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.izhixin.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.izzd.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.j2n.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.jiazicloud.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200000990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.keck.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.kinsley.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.mcclure.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.mnft.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200000994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.mobiles.world"; content:"Host"; http_header; classtype:attempted-recon; sid:200000995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.ocular.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.otzarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200000997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.pecker.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200000998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.pens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200000999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.pete.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200001000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.ptzh.com.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.qiyi.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200001002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.qrgj.com.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.quanshikong.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.rictwz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.selfie.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200001006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.tianzhujiao.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.txiwjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.tzngly.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.uayuxc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.ufwybn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.wangcaitongbao2.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200001012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.wetot.asia"; content:"Host"; http_header; classtype:attempted-recon; sid:200001013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.wetot.beer"; content:"Host"; http_header; classtype:attempted-recon; sid:200001014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.wetot.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200001015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.wetot.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.wetot.center"; content:"Host"; http_header; classtype:attempted-recon; sid:200001017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.wetot.city"; content:"Host"; http_header; classtype:attempted-recon; sid:200001018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.wetot.cloud"; content:"Host"; http_header; classtype:attempted-recon; sid:200001019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.wetot.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200001020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.wetot.email"; content:"Host"; http_header; classtype:attempted-recon; sid:200001021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.wetot.kim"; content:"Host"; http_header; classtype:attempted-recon; sid:200001022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.wetot.plus"; content:"Host"; http_header; classtype:attempted-recon; sid:200001023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.wetot.red"; content:"Host"; http_header; classtype:attempted-recon; sid:200001024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.wetot.show"; content:"Host"; http_header; classtype:attempted-recon; sid:200001025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.wetot.today"; content:"Host"; http_header; classtype:attempted-recon; sid:200001026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.wetot.work"; content:"Host"; http_header; classtype:attempted-recon; sid:200001027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.wetot.world"; content:"Host"; http_header; classtype:attempted-recon; sid:200001028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.wnsvnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.xwjimg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.xxbjzt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.yameimei.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.ybtamg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.ycqdte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.yhyyti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.youmeitan.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.yviwho.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.yymowi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.zaweli.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.zenwzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.zetkvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.zgepsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.zhaotata.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.zjnkse.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.znepgh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.znknig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.znqehi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.zstyum.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesocsn.aoeescoecone.zuigongpin.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.00jd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.01ov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.03an.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.aifrench.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200001053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.chongsiling.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.crystals.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200001055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.efficiency.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200001056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.eshare.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200001057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.fashions.show"; content:"Host"; http_header; classtype:attempted-recon; sid:200001058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.footballs.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200001059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.gangtiemao.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.guochanhua.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.harford.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200001062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.healey.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200001063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.healthy-liv.fit"; content:"Host"; http_header; classtype:attempted-recon; sid:200001064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.ihetao.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.iiot.today"; content:"Host"; http_header; classtype:attempted-recon; sid:200001066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.ijingzhun.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.ijzy.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.ilechun.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.ipangxin.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.ipengyou.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.ippq.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.iscr.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.iwym.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.ixyg.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.iyouqiu.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.izhixin.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.izzd.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.j2n.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.jiazicloud.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.keck.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200001081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.kinsley.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200001082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.mcclure.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200001083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.mnft.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200001084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.mobiles.world"; content:"Host"; http_header; classtype:attempted-recon; sid:200001085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.ocular.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200001086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.otzarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.pecker.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200001088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.pens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200001089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.pete.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200001090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.ptzh.com.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.qiyi.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200001092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.qrgj.com.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.quanshikong.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.rictwz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.selfie.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200001096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.tianzhujiao.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.txiwjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.tzngly.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.uayuxc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.ufwybn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.wangcaitongbao2.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200001102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.wetot.asia"; content:"Host"; http_header; classtype:attempted-recon; sid:200001103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.wetot.beer"; content:"Host"; http_header; classtype:attempted-recon; sid:200001104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.wetot.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200001105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.wetot.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.wetot.center"; content:"Host"; http_header; classtype:attempted-recon; sid:200001107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.wetot.city"; content:"Host"; http_header; classtype:attempted-recon; sid:200001108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.wetot.cloud"; content:"Host"; http_header; classtype:attempted-recon; sid:200001109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.wetot.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200001110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.wetot.email"; content:"Host"; http_header; classtype:attempted-recon; sid:200001111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.wetot.kim"; content:"Host"; http_header; classtype:attempted-recon; sid:200001112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.wetot.plus"; content:"Host"; http_header; classtype:attempted-recon; sid:200001113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.wetot.red"; content:"Host"; http_header; classtype:attempted-recon; sid:200001114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.wetot.show"; content:"Host"; http_header; classtype:attempted-recon; sid:200001115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.wetot.today"; content:"Host"; http_header; classtype:attempted-recon; sid:200001116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.wetot.work"; content:"Host"; http_header; classtype:attempted-recon; sid:200001117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.wetot.world"; content:"Host"; http_header; classtype:attempted-recon; sid:200001118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.wnsvnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.xwjimg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.xxbjzt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.yameimei.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.ybtamg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.ycqdte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.yhyyti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.youmeitan.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.yviwho.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.yymowi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.zaweli.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.zenwzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.zetkvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.zgepsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.zhaotata.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.zjnkse.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.znepgh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.znknig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.znqehi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.zstyum.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesoen.asecosone.zuigongpin.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.00jd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.01ov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.03an.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.aifrench.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200001143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.chongsiling.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.crystals.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200001145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.efficiency.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200001146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.eshare.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200001147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.fashions.show"; content:"Host"; http_header; classtype:attempted-recon; sid:200001148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.footballs.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200001149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.gangtiemao.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.guochanhua.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.harford.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200001152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.healey.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200001153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.healthy-liv.fit"; content:"Host"; http_header; classtype:attempted-recon; sid:200001154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.ihetao.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.iiot.today"; content:"Host"; http_header; classtype:attempted-recon; sid:200001156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.ijingzhun.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.ijzy.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.ilechun.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.ipangxin.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.ipengyou.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.ippq.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.iscr.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.iwym.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.ixyg.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.iyouqiu.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.izhixin.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.izzd.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.j2n.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.jiazicloud.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.keck.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200001171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.kinsley.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200001172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.mcclure.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200001173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.mnft.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200001174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.mobiles.world"; content:"Host"; http_header; classtype:attempted-recon; sid:200001175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.ocular.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200001176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.otzarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.pens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200001178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.pete.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200001179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.ptzh.com.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.qiyi.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200001181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.qrgj.com.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.quanshikong.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.rictwz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.selfie.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200001185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.tianzhujiao.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.txiwjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.tzngly.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.uayuxc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.ufwybn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.wangcaitongbao2.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200001191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.wetot.asia"; content:"Host"; http_header; classtype:attempted-recon; sid:200001192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.wetot.beer"; content:"Host"; http_header; classtype:attempted-recon; sid:200001193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.wetot.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200001194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.wetot.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.wetot.center"; content:"Host"; http_header; classtype:attempted-recon; sid:200001196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.wetot.city"; content:"Host"; http_header; classtype:attempted-recon; sid:200001197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.wetot.cloud"; content:"Host"; http_header; classtype:attempted-recon; sid:200001198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.wetot.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200001199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.wetot.email"; content:"Host"; http_header; classtype:attempted-recon; sid:200001200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.wetot.kim"; content:"Host"; http_header; classtype:attempted-recon; sid:200001201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.wetot.plus"; content:"Host"; http_header; classtype:attempted-recon; sid:200001202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.wetot.red"; content:"Host"; http_header; classtype:attempted-recon; sid:200001203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.wetot.show"; content:"Host"; http_header; classtype:attempted-recon; sid:200001204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.wetot.today"; content:"Host"; http_header; classtype:attempted-recon; sid:200001205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.wetot.work"; content:"Host"; http_header; classtype:attempted-recon; sid:200001206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.wetot.world"; content:"Host"; http_header; classtype:attempted-recon; sid:200001207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.wnsvnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.xwjimg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.xxbjzt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.yameimei.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.ybtamg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.ycqdte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.yhyyti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.youmeitan.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.yviwho.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.yymowi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.zaweli.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.zenwzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.zetkvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.zgepsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.zhaotata.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.zjnkse.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.znepgh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.znknig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.znqehi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.zstyum.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aesosn.aoeesccone.zuigongpin.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aet-tankers.comczx8ghqxiei7zwvviftmczx8ghqxiei7zwvviftmczx8ghqxiei7zwvviftm.fiveclean.ma"; content:"Host"; http_header; classtype:attempted-recon; sid:200001229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"afeadfgc.odoo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"affixwallet.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200001231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"afp--futuro.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"afp-retiro.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200001233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"afromanic.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"afterpay.vip"; content:"Host"; http_header; classtype:attempted-recon; sid:200001235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"age.a7qy.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200001236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aged-breeze-3230.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200001237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agence-wordpress-bordeaux.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agent.bhifly75390.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agent.bhiflyk40710.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200001240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agent.bhiflyk41287.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200001241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agent.bhiflyk69875.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200001242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agent.bhiflyk69965.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200001243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agent.bhiflyk84276.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200001244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agent.bsxctmkgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agent.cbxdwjl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agent.cwgtmkgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agent.dcgobmyh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agent.deutschemkgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agent.dwpq985.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200001250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agent.hrxymkdw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agent.itbitwde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agent.kpdgmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agente-gyt-continental-com-gt.webnode.es"; content:"Host"; http_header; classtype:attempted-recon; sid:200001254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agi-foundation.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agneyanw.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agri-cole-fr-t-i.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agrimetiersmartinique.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200001258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agroblockchain.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200001259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"agsdwarka.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aheaddrive.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200001261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ahktbbimem.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ahktbbimem.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aib-security-applogin.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aib-security-loginapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aizik-whatsapp-firebase-clone.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ajudacef.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"akanksha3012.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200001268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"akemidentalspecialists.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"akperkridahusada.siakad.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200001270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aks34.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200001271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aktualizacja.jst.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200001272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aktuelle-information.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200001273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alacrit.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aladdincamp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alareentading-catalog.page.tl"; content:"Host"; http_header; classtype:attempted-recon; sid:200001276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alayohomes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"albaraka-bank.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200001278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"albel.intnet.mu"; content:"Host"; http_header; classtype:attempted-recon; sid:200001279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"albertoliviera014.outgrow.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200001280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aldana.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200001281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alert-citizensbank.heseemscool.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alertadminboxsb.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alertas-bancofalabella.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alerts-coonnect-xfiniity-com.preview-domain.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alerts.department.improvement.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200001286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aleskausa.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alfioponzi.adv.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200001288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"algotextil.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200001289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alharaj-alalmi.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alialinedssc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aliciabot.azurewebsites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200001292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alimentosybebidasrefrespul.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alinafischer.clickfunnels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"allbrowardanimalremoval.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alleqrolokalnie.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200001296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"allerganpartnerprivilege.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alliancecreditunion.co.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200001298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alliedschoolsahiwal.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"allindiatransportservices.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"allwest-appraisal.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"almotairy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alphalog.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200001303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alphawallet.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200001304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alsofft.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"altecmetalltechnik-energiasolar.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"altunhaliyikama.com.tr"; content:"Host"; http_header; classtype:attempted-recon; sid:200001307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"alunnesantacaterina.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200001308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ama.anazon.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200001309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amacard-updata.px067a.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200001310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amankan-akun-tautan.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amankan-akunfb-anda.webnode.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200001312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amanno.co.jp.hbshishi.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200001313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amaozn.ywcimei.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amappzoou-jp-sfdffas.ogudm.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amausercard-data.nmzku8.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200001316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amazing-lalande.141-98-6-153.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200001317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amazion-jp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amazon-co.cojpcc10.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amazon-interruption.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amazon-notifies-jp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amazon-ssr-com.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200001322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amazon.aireaw.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amazon.co.jp.ajfhe854ong.broruasma.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amazon.co.jp.doeua79ong.ofmcsaea.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amazon.co.jp.odfkgfi01sh.nvbsdorja.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amazon.co.jp.world-ekkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amazon.cp.jp.encodingutf8pdrdwb0ytucontent.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200001328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amazon.imsj.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amazon.jp-lh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amazon.pesj.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amazon.works.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200001332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amazon1.hsxjma.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200001333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amazon2.ifllaq.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200001334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amazonb.gq"; content:"Host"; http_header; classtype:attempted-recon; sid:200001335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amazoninfotpe.guochanyx.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amazonvipste.niuzhaopin.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ambiencenews.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ambrrygen.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ambrygen.care"; content:"Host"; http_header; classtype:attempted-recon; sid:200001340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amc-training.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"americafirstcu.thelocals.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200001342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"americanas55.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amfauth-00.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amfc-auth.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amfc-auth.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amidabuli.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amintechuae.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amirhameed.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amm-uni.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amosleh.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amproagency.sk"; content:"Host"; http_header; classtype:attempted-recon; sid:200001352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ampunbanaa.topijerami.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200001353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amreeth.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200001354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amriybrod.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amrstewardshipuganda.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"amtrakaccount.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anandsr-dev.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200001358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anapolisemprego.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200001359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anarchitecturestudio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anazaon.co.jp.login.tyjrcdh.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ancient-cloud-12a9.wdavis5428586.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200001362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ancient-voice-a281.attnetmms78.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200001363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ancient.tybocas.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200001364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"andersonstrategic.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200001365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"andmantelionazxpionloasion.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"andmantelionazxpionloasion.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aneesdental.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"angelafarnsworthphotography.lancemanconstruction.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"angindatanglahh.martulangsore.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200001370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"angry-elbakyan.188-127-227-70.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200001371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anjalijha167.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200001372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"annako.bwbkqud.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anpost.customersfee-ie.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"antiguacasona.com.ar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"antillesauthentification.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anushaaneel.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anwalt-gesellschaftsrecht.ch"; content:"Host"; http_header; classtype:attempted-recon; sid:200001378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"anxiousartists.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoeu-aaosoauuu.chenmanqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoeu-aaosoauuu.rwmcr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoeu-aaosoauuu.uvlhwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoeu-aaosoauuu.wiguyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoeu-aaosoauuu.wkbakq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoeu-aaosoauuu.wotygl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoeu-aaosoauuu.xubnkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoeu-aaosoauuu.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoeu-aaosoauuu.ybmkwa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoeu-aaosoauuu.ydpssl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoeu-aaosoauuu.yfsjiq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoeu-aaosoauuu.ytbspo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoeu-aaosoauuu.yyyuwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoeu-aaosoauuu.yyzded.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoeu-aaosoauuu.zusrue.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aol--successfullogin-update-form-292841.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aolxperience.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aop24-fyaaa-aaaad-qc74q-cai.ic.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200001397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.00jd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.01ov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.03an.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.aifrench.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200001401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.chongsiling.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.crystals.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200001403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.efficiency.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200001404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.eshare.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200001405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.fashions.show"; content:"Host"; http_header; classtype:attempted-recon; sid:200001406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.footballs.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200001407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.gangtiemao.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.guochanhua.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.harford.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200001410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.healey.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200001411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.healthy-liv.fit"; content:"Host"; http_header; classtype:attempted-recon; sid:200001412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.ihetao.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.iiot.today"; content:"Host"; http_header; classtype:attempted-recon; sid:200001414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.ijingzhun.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.ijzy.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.ilechun.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.ipangxin.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.ipengyou.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.ippq.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.iscr.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.iwym.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.ixyg.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.iyouqiu.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.izhixin.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.izzd.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.j2n.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.jiazicloud.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.keck.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200001429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.kinsley.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200001430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.mcclure.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200001431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.mnft.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200001432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.mobiles.world"; content:"Host"; http_header; classtype:attempted-recon; sid:200001433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.ocular.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200001434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.otzarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.pecker.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200001436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.pens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200001437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.pete.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200001438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.ptzh.com.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.qiyi.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200001440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.qrgj.com.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.quanshikong.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.rictwz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.selfie.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200001444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.tianzhujiao.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.txiwjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.tzngly.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.uayuxc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.ufwybn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.wangcaitongbao2.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200001450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.wetot.asia"; content:"Host"; http_header; classtype:attempted-recon; sid:200001451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.wetot.beer"; content:"Host"; http_header; classtype:attempted-recon; sid:200001452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.wetot.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200001453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.wetot.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.wetot.center"; content:"Host"; http_header; classtype:attempted-recon; sid:200001455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.wetot.city"; content:"Host"; http_header; classtype:attempted-recon; sid:200001456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.wetot.cloud"; content:"Host"; http_header; classtype:attempted-recon; sid:200001457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.wetot.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200001458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.wetot.email"; content:"Host"; http_header; classtype:attempted-recon; sid:200001459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.wetot.kim"; content:"Host"; http_header; classtype:attempted-recon; sid:200001460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.wetot.plus"; content:"Host"; http_header; classtype:attempted-recon; sid:200001461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.wetot.red"; content:"Host"; http_header; classtype:attempted-recon; sid:200001462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.wetot.show"; content:"Host"; http_header; classtype:attempted-recon; sid:200001463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.wetot.today"; content:"Host"; http_header; classtype:attempted-recon; sid:200001464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.wetot.work"; content:"Host"; http_header; classtype:attempted-recon; sid:200001465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.wetot.world"; content:"Host"; http_header; classtype:attempted-recon; sid:200001466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.wnsvnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.xwjimg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.xxbjzt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.yameimei.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.ybtamg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.ycqdte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.yhyyti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.youmeitan.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.yviwho.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.yymowi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.zaweli.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.zenwzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.zetkvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.zgepsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.zhaotata.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.zjnkse.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.znepgh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.znknig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.znqehi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.zstyum.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosceocn.acseoosn.zuigongpin.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.00jd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.01ov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.03an.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.aifrench.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200001491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.chongsiling.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.crystals.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200001493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.efficiency.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200001494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.eshare.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200001495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.fashions.show"; content:"Host"; http_header; classtype:attempted-recon; sid:200001496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.footballs.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200001497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.gangtiemao.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.guochanhua.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.harford.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200001500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.healey.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200001501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.healthy-liv.fit"; content:"Host"; http_header; classtype:attempted-recon; sid:200001502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.ihetao.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.iiot.today"; content:"Host"; http_header; classtype:attempted-recon; sid:200001504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.ijingzhun.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.ijzy.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.ilechun.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.ipangxin.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.ipengyou.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.ippq.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.iscr.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.iwym.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.ixyg.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.iyouqiu.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.izhixin.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.izzd.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.j2n.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.keck.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200001518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.kinsley.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200001519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.mcclure.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200001520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.mnft.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200001521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.mobiles.world"; content:"Host"; http_header; classtype:attempted-recon; sid:200001522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.ocular.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200001523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.otzarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.pecker.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200001525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.pens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200001526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.pete.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200001527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.ptzh.com.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.qiyi.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200001529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.qrgj.com.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.quanshikong.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.rictwz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.selfie.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200001533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.tianzhujiao.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.txiwjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.tzngly.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.uayuxc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.ufwybn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.wangcaitongbao2.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200001539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.wetot.asia"; content:"Host"; http_header; classtype:attempted-recon; sid:200001540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.wetot.beer"; content:"Host"; http_header; classtype:attempted-recon; sid:200001541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.wetot.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200001542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.wetot.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.wetot.center"; content:"Host"; http_header; classtype:attempted-recon; sid:200001544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.wetot.city"; content:"Host"; http_header; classtype:attempted-recon; sid:200001545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.wetot.cloud"; content:"Host"; http_header; classtype:attempted-recon; sid:200001546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.wetot.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200001547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.wetot.email"; content:"Host"; http_header; classtype:attempted-recon; sid:200001548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.wetot.kim"; content:"Host"; http_header; classtype:attempted-recon; sid:200001549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.wetot.plus"; content:"Host"; http_header; classtype:attempted-recon; sid:200001550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.wetot.red"; content:"Host"; http_header; classtype:attempted-recon; sid:200001551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.wetot.show"; content:"Host"; http_header; classtype:attempted-recon; sid:200001552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.wetot.today"; content:"Host"; http_header; classtype:attempted-recon; sid:200001553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.wetot.work"; content:"Host"; http_header; classtype:attempted-recon; sid:200001554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.wetot.world"; content:"Host"; http_header; classtype:attempted-recon; sid:200001555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.wnsvnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.xwjimg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.xxbjzt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.yameimei.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.ybtamg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.ycqdte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.yhyyti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.youmeitan.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.yviwho.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.yymowi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.zaweli.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.zenwzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.zetkvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.zgepsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.zhaotata.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.zjnkse.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.znepgh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.znknig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.znqehi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.zstyum.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aosecocn.acseooesn.zuigongpin.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.00jd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.01ov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.03an.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.aifrench.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200001580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.chongsiling.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.crystals.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200001582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.efficiency.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200001583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.eshare.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200001584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.fashions.show"; content:"Host"; http_header; classtype:attempted-recon; sid:200001585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.footballs.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200001586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.gangtiemao.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.guochanhua.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.harford.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200001589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.healey.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200001590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.healthy-liv.fit"; content:"Host"; http_header; classtype:attempted-recon; sid:200001591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.ihetao.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.iiot.today"; content:"Host"; http_header; classtype:attempted-recon; sid:200001593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.ijingzhun.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.ijzy.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.ilechun.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.ipangxin.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.ipengyou.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.ippq.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.iscr.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.iwym.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.ixyg.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.iyouqiu.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.izhixin.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.izzd.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.j2n.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.jiazicloud.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.keck.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200001608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.kinsley.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200001609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.mcclure.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200001610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.mnft.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200001611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.mobiles.world"; content:"Host"; http_header; classtype:attempted-recon; sid:200001612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.ocular.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200001613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.otzarc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.pecker.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200001615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.pens.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200001616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.pete.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200001617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.ptzh.com.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.qiyi.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200001619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.qrgj.com.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.quanshikong.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.rictwz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.selfie.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200001623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.tianzhujiao.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.txiwjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.tzngly.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.uayuxc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.ufwybn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.wangcaitongbao2.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200001629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.wetot.asia"; content:"Host"; http_header; classtype:attempted-recon; sid:200001630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.wetot.beer"; content:"Host"; http_header; classtype:attempted-recon; sid:200001631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.wetot.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200001632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.wetot.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.wetot.center"; content:"Host"; http_header; classtype:attempted-recon; sid:200001634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.wetot.city"; content:"Host"; http_header; classtype:attempted-recon; sid:200001635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.wetot.cloud"; content:"Host"; http_header; classtype:attempted-recon; sid:200001636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.wetot.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200001637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.wetot.email"; content:"Host"; http_header; classtype:attempted-recon; sid:200001638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.wetot.kim"; content:"Host"; http_header; classtype:attempted-recon; sid:200001639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.wetot.plus"; content:"Host"; http_header; classtype:attempted-recon; sid:200001640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.wetot.red"; content:"Host"; http_header; classtype:attempted-recon; sid:200001641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.wetot.show"; content:"Host"; http_header; classtype:attempted-recon; sid:200001642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.wetot.today"; content:"Host"; http_header; classtype:attempted-recon; sid:200001643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.wetot.work"; content:"Host"; http_header; classtype:attempted-recon; sid:200001644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.wetot.world"; content:"Host"; http_header; classtype:attempted-recon; sid:200001645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.wnsvnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.xwjimg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.xxbjzt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.yameimei.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.ybtamg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.ycqdte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.yhyyti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.youmeitan.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.yviwho.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.yymowi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.zaweli.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.zenwzp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.zetkvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.zgepsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.zhaotata.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.zjnkse.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.znepgh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.znknig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.znqehi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.zstyum.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aoseocn.acseosn.zuigongpin.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200001666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ap-bombcrypto-ol.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ape-club.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200001668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ape-stepn.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apelive.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200001670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apex-identity.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"api.51.fi"; content:"Host"; http_header; classtype:attempted-recon; sid:200001672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"api.collab-land.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200001673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"api.inexxus.digital"; content:"Host"; http_header; classtype:attempted-recon; sid:200001674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apldfre.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aplintec.com.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200001676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app--bombcrypto-io--acess.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app-beier.kezunlxgra-ewl6n1jmj352.p.runcloud.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200001678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app-bluk.upvzza0dit-95m32w9zd3rv.p.runcloud.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200001679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app-fg.zvleta8m74-ewx3l8pll4zq.p.runcloud.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200001680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app-morissette.kezunlxgra-ewl6n1jmj352.p.runcloud.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200001681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app-poly-g0nwebsite.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app-schmeler.kezunlxgra-ewl6n1jmj352.p.runcloud.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200001683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app-stehr.3gqmmiuqkk-ypj68wjoo6l2.p.runcloud.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200001684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app-susshi.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.aavelp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.aavelp.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.assessmentgenerator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.bydn217.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200001689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.formbuilder.ai"; content:"Host"; http_header; classtype:attempted-recon; sid:200001690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.hubgdpr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.managesend.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.mirorfinance.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.moneylinecreditcorporation.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.singlelink.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200001695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.sugarsync.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.swap-biswap.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app.webwalletsauthenticate.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"app42.host"; content:"Host"; http_header; classtype:attempted-recon; sid:200001699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"appbtconnectnet.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"appcef2022.10001mb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"appdefisnet.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200001702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"appeal-report-30521.herokuapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"appeal-report-64607.herokuapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"appeal-report-64608.herokuapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"appeal-report-64609.herokuapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"appeal-report-64610.herokuapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apple-id-auth.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apple-id-auth.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apple-portal-online-support.account-tmobile-business.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"apple.com-kt.cloud"; content:"Host"; http_header; classtype:attempted-recon; sid:200001711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"appreter.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200001712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"appsdiezric.5gjdv9azyu-yk26e5knz679.p.runcloud.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200001713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"appsrecoverrpa4g3es-s4f3ty641c0mf1rm4t10n32.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"appsrecoverrpagesc0mf1rm4t10n32sadss.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"appsuite.currentplug.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200001716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aquadynamics.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200001717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aquarelle.es"; content:"Host"; http_header; classtype:attempted-recon; sid:200001718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aquzea.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"arabianoasis.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"arafathrumman.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200001721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"arch.skulls-marketing.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"area-digitalmps.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200001723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"areaclientibper.freebiodataformat.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"areaclientibperbanca.jicis.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"areaclientibperbanca.mhac.world"; content:"Host"; http_header; classtype:attempted-recon; sid:200001726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"areaclientibperbanca.svijetlastranadisleksije.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"areamenagerinternet.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200001728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"areampsdigitele.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200001729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"areapersonalewebmps.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200001730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ariseairconservices.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"arlindovsky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200001732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"arnaldolanches.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"arrancadoresyalternadores.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"arre-9do.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200001735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"arrivingfriday.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"arrozsabanero.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"arslandach.at"; content:"Host"; http_header; classtype:attempted-recon; sid:200001738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"arson20sh.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"artale.co.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200001740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"artash65sh.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"arthamahotels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"artiwqx.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"arub-service.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"as9192030.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asdrewd.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200001746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asfdhf.lgowiu.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ashleymadison10.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"askarmotorluaraclar.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asniceax.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asraralmashaher.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"assessoriabradesco.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200001752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"assetsrestore.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"assisstance-admin.onedumb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"assisstance-admin.sexidude.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"assisstance-admin.zzux.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"assistance-mail.ddnsking.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"assistancepaiementsecurise.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"assistenzadigital-mps.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"assurance-la-banque-postale.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"assurance-la-banque-postale.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"assure.espaselems.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200001762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"astrologyhouse.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200001763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"asuka-kohsan.co.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200001764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"at-service.recoveryatt.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200001765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"at-t-support-service1.sitey.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200001766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"at-t-yahoo.sitey.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200001767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"at-t0987.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"at0.srev.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200001769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atendimento-bradesco.topmidia.tv.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200001770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atento-fdi.plusoftomni.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200001771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"athensgoldandsilver.gr"; content:"Host"; http_header; classtype:attempted-recon; sid:200001772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atllt.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atm-i.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atmosdesign.com.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200001775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atnr76dxku336szy.clickfunnels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-103327.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-105431.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200001778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-106427.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-account.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att-yahoo-mail-107991.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200001781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att.con-account.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200001782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"att1.sitey.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200001783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attacker.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attcustomerservices.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attemplate.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attivadati2022.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attmailcustomervice.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attmailgdc.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attmailurd.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attnetcoope2.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attonline-mail.netlify.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attorneyfileshare.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attorneyfileshare.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attserviceupdate.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200001795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attwebb767.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"attzcxffclfjlggflggghjjhjljhjjhhk.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atualizarliveio.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200001798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"atualizeapp.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200001799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-bendigo.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-bendigo.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.79rme3.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.agfttos.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.ai726.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.akgtkqf.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.ampumsu.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.blobmff.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.btewfcd.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.ckrthcx.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.curjfka.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.datmmbu.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.dgmuhdn.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.dhcrm.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.dmfmhun.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.edeadqq.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.ejtrycv.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.ejxhbxf.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.emboohs.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.emqhgti.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.enokpmd.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.er265.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.eyxfmja.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.fhkabzb.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.fofzpkt.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.fprrknr.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.fptmbow.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.fuqikbf.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.fuxmwla.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.fxlvddi.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.gklkmiq.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.gkmrbql.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.gmypbhy.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.gtukcdi.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.ibpqmu.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.ibvtclg.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.jexmcve.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.jfakbld.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.juvcznh.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.jwiuydw.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.komxdnz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.kuwijlx.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.kyfudia.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.ldhqygi.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.lqcrm.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.lqrvnle.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.lthpann.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.mcaujje.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.mcmk7t.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.mdzvqkt.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.misdvm.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.mjkzvhn.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.nfhoiwv.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.nmmbhhbsjskks.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.p9sdwu.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.pjmvdvd.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.plygtma.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.qbawlem.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.qbjgagx.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.qnkjvhv.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.rbelmbr.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.rljdssk.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.rnlbhta.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.sdtdutv.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.sjnpmcx.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.srupsud.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.tenyiun.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.tjyzdao.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.tpgdvwg.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.tzf0ep.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.ui133.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.un027.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.urovjeq.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.vcnpwub.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.vqonyrb.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.vyylgzm.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.whdqkog.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.wztkbqn.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.xhhagji.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.xpcrm.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.xrbzhxw.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.yapqfel.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.yntct.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.yuvvxgy.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.zagoyau.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"au-pay-auoneo.ztdtyxo.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aucblzx.hclcsolutions.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aui493849934324zim.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aui493849934324zim.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aulamed.com.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200001889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aumenta.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200001890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aumentdisp.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200001891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aumentocupo20221.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200001892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aumentocupotuya.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200001893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aumentolendario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aumentos.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200001895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aunment.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200001896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aupay-update-jp.ap3eg.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aupay-update-jp.ctpjpbn.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aupay-update-jp.dfnuift.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aupay-update-jp.dxftrpt.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aupay-update-jp.fggqdah.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aupay-update-jp.sjrjcjt.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aupay-update-jp.tgekieh.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aupay-update-jp.vikubmk.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200001904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auraschoolpmna.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aureliengaborit.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200001906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"austinl33.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200001907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"australia-medication-fight-figures.trycloudflare.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auth-ageverification.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auth-document-shared.datingg-voice.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200001910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auth-id-apple.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auth-id-apple.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auth-task1-m.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auth0sharefid0000000200000ff1ce009id31d2bb9c.auth0rizesharedo.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200001914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authenticate-0oxsoxauthe.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200001915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authenticator-email1.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authenticator-email11.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authenticator-email11.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authenticator-email12.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authenticator-email13.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authenticator-email15.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authenticator-email19.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authenticator-email2.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authenticator-email2.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authenticator-email21.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authenticator-email21.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authenticator-email26.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authenticator-email26.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authenticator-email35.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authenticator-email35.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authenticator-email37.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authenticator-email37.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authenticator-email42.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authenticator-email42.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authenticator-email44.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authenticator-email44.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authenticator-email45.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authenticator-email46.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authenticator-email51.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authenticator-email55.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authenticator-email58.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authenticator-email59.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authenticator-email69.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authenticator-email69.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authenticator-email72.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authenticator-email73.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authenticator-email79.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authenticator-email8.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authenticator-email8.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authenticator-email84.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authenticator-email84.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authenticator-email94.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authenticator-email96.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authentificationpaiement-servicesecurise.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200001954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authmobilecertigroupverifieinfosplus.justns.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200001955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"authuxeehmutconjxmailssocl.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"autodiscover.ryder-dutton.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200001957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"autoexprs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"autohauspodcast.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200001959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"autoranplususeremailprocessingupdate.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200001960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"autorectifytoken.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200001961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"autoscurt24.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200001962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"autoservis-vucic.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"autumn-bonus-2541.flexloop5423240.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200001964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"autumn-sun-4a21.paqesads-scure.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200001965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"auxxxxxxxxx.smb.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200001966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aviooz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"avisaboneee.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"awesome-leaders.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"awj7w-gyaaa-aaaad-qdcdq-cai.ic.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200001970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"awsprimevideo.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200001971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axia-land.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axie-infinity.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200001973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axie-land-page.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axieinfinily.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200001975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axieinfinity.simt.ind.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200001976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axieinfinity1.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axieinfinitydownload.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200001978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axieinfinityme.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200001979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axienfinity.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200001980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axiinninfinityp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axjalnfinjty.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axlujnflnjty.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"axlulnflnlty.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"aysenurbozdogan.av.tr"; content:"Host"; http_header; classtype:attempted-recon; sid:200001985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"azautecere.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200001986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"azerbaijantourism.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200001987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"azimutyachts.miami"; content:"Host"; http_header; classtype:attempted-recon; sid:200001988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"azizi-developments.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"azqpom.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"azuki-110716005.vercel.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"azuki-mint-connect.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200001992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"azuki.com.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200001993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"b.com.0cdb6084fc320a42a6418192753f5960.laremolonarestaurante.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"b059c86968a6427389952025bcee9886.svc.dynamics.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"b169b5ea-e768-4486-b865-29fb3d61ec56.id.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200001996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"b189511c3d.nxcli.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200001997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"b2bxenz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200001998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"b4e921f0.sso-mailsrvr-4344e5teed.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200001999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"b97bca39.srvr-cloudmail-srvr6754e5rte.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"babaprints.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"babbybitcoin.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"backend.b2bxmkgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"backend.bahif9042.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"backend.bhifly75390.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"backend.bhiflyk36637.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"backend.bhiflyk40943.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"backend.bhiflyk41548.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"backend.bhiflyk42562.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"backend.bhiflyk47155.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"backend.bhiflyk48573.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"backend.bhiflyk63663.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"backend.bhiflyk64168.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"backend.bhiflyk67888.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"backend.bhiflyk74074.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"backend.bhiflyk84276.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"backend.boursobmyh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"backend.bqsjia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"backend.bsxctmkgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"backend.cbxdwjl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"backend.cbxkmmkgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"backend.cfhrjfw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"backend.coinsdtwde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"backend.coppermkdw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"backend.cwgtmkgw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"backend.dcgobmyh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"backend.madridfrlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"backend.transabmyh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bacpayee.contactin.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200002029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"badaso-staging.uatech.co.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200002030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"baerary.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200002031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bafkreif3dd4pxft7xsxo7msjx5wiwpjd4dgfnlk5xuh5gja3ewnutg4hgm.ipfs.nftstorage.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200002032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bafkreigbzs3va4y7kf2vekf4fhqgxn5rqss7nvcpxr42s3h4puvna7bqfy.ipfs.nftstorage.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200002033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bafybeiadadrln2nemqsmq6srmizynuxtg424alfixjdhyqsotaw36foc74.ipfs.nftstorage.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200002034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bafybeiap7l35l44tbajiyyyhxxj25xp2xm4cnfyyvfz6pai526u6docfzm.ipfs.nftstorage.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200002035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bafybeiaut7qfd2hc4ubg4h5rwunfwavrn2kwwbtvlr3zdyshpkqbnvlgha.ipfs.dweb.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200002036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bafybeiazy3ak4k63jaal2dwl4ec4dyk4jf42c6lllpokzwwevvqa6ff4zy.ipfs.nftstorage.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200002037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bafybeib2excuvsdgcr44b3u6rpphnzicwokgcczkw2ktena5fop3bndvou.ipfs.nftstorage.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200002038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bafybeibb7qrouliinluvzztpm7qthzrxcelvc5hkzh7kt3r5q53odc2m6u.ipfs.nftstorage.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200002039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bafybeibbtgciqnm6pqlscopyh556im5rqvwarla6voi4n7okpx6ai3aeci.ipfs.nftstorage.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200002040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bafybeibkgs25boasw2frw5zuzdxotemdkaj6pjup6jjhownignkogjqp6a.ipfs.dweb.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200002041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bafybeibwteteysxljum4owlusptthmqqik3h6r3tce7sx23duelarphxgu.ipfs.nftstorage.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200002042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bafybeicnh6wydaor7avpgj233uhc637jgehenqlqxz6fbuaaa5fmiwopzq.ipfs.nftstorage.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200002043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bafybeicp3x52jgy3qhsrwaioemeck7vhnryq2i2dgodkakkixuzruo54wa.ipfs.nftstorage.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200002044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bafybeidrh56vohkluey3kp3firhbnvl2vutctx5cgdnjnipjj4sgyfs5vq.ipfs.infura-ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bafybeiexhhfrj2e7perd5epep3mogqk3go2zlalrl6ftuttuxunh7hhlf4.ipfs.nftstorage.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200002046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bafybeifhsjjusavaqlm3dbhe2tpkwv4hfynw3hulvrccrl6kyh3tr5qpbi.ipfs.nftstorage.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200002047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bafybeigdmxqlghpq5drtil4zy5ydi6kgcx2ect2okv37f76bhw5dmkrh2y.ipfs.nftstorage.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200002048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bafybeiguaf6rpbde6hfl4sqddjsu6euagjkugnkkbsulc5ywcajbtj3lvu.ipfs.dweb.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200002049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bafybeihhmu3tbal4s25nql5zoh7665f34lz6lbju626mkzucm3qlv33dri.ipfs.nftstorage.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200002050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bafybeihwqgsiib3farmchcqmdvcm5s2sg25jh3rjgaurart6nxcgvhxbau.ipfs.nftstorage.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200002051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bakhai.vn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"baleariclifestyle.be"; content:"Host"; http_header; classtype:attempted-recon; sid:200002053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"banbifemprsas.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"banca-electronica1.odoo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bancafinancieraendidadficohsa.ficohs.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bancaporinterneinterbank.pe-loginn.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200002057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bancaporinternet.interbak.pe.softjonub.ir"; content:"Host"; http_header; classtype:attempted-recon; sid:200002058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bancaporlnternetlnterbarnk.aaabestratesmoving.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bancaporlnternetlnterbarnk.agimax.com.pe"; content:"Host"; http_header; classtype:attempted-recon; sid:200002060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bancaporlnternetlnterbarnk.danielaalmeida.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bancaporlnternetlnterbarnk.fannysigns.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bancaporlnternetlnterbarnk.libertycanais.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200002063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bancaporlnternetlntrbannk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bancobpi.pt.darmag.webd.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200002065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bancogeneralpm.c1.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"banconacional040.ultimatefreehost.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200002067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bancor-amm.rip"; content:"Host"; http_header; classtype:attempted-recon; sid:200002068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"banditcoil.augeprint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bank.amilbank.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200002070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"banken-online.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"banki0wa.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200002072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bannerbank.control-inc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"baradua.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200002074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bardgdf.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"barncaenlineapelnterbarnk.produttive.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200002076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"basketbackup.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"baterias20.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200002078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"battlebikefitness.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bavarianhaven1.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bavarianhaven1.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bayclive.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"baytmall.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bbexdfvq.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200002084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bbkano.mystoreden.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bbmaconline.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bbtinternet.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bc.indigital.company"; content:"Host"; http_header; classtype:attempted-recon; sid:200002088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bcdc1cde.sibforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bcp-marketing.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bdc-canada.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bdcsvr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bdfds.skfv0ob.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bdrive-0utlook-datastorage.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bdrive-0utlook-datastorage.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"be34r5thg-b0j345e-0rg-0ehwrg-09h5eg.obs.ap-southeast-2.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"beachhead-solutions.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"beacon.marylands.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bearmon.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200002099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bearmybrand.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"beautology.co.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200002101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"beautylablaser.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"behrtec.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"beingmelinda.organicmelinda.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bekairos.se"; content:"Host"; http_header; classtype:attempted-recon; sid:200002105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"belle4me78.es.tl"; content:"Host"; http_header; classtype:attempted-recon; sid:200002106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bellevuefintech.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bellsouth-upgradeds-site.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bendigobankalert.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"beneficiotuyapay.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200002110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bericht.t-exponent.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bestdeckinstallers.dubbedmedia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bestpriceacunits.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"betamedia.com.ng"; content:"Host"; http_header; classtype:attempted-recon; sid:200002114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"betasegura-viabcp.movil-sms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"betterstancd-elementlocales.herokuapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bettr5362.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bexwebmailupdate.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"beyondcryptofx.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bfaszdyttb.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bfcvc.uvhnhon.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bfdcx.izipmid.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bfdcx.rbtlbtg.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bgielectrical.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200002124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bgvfdc.ydgibta.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bharathi1809.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bhavin0077.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bhgfv.l7npmdd.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bhtyfd.5hwxvd3.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"biblioteca.sicrediprogresso.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200002130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"biblioudv.ro"; content:"Host"; http_header; classtype:attempted-recon; sid:200002131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"biboxwen.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bicicentroslezama.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bienvenidosanuestrocanal.pousadacorais.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200002134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bienvenidosanuestroportal.mcranches.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bienvenueespace.podia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bier-be.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bigshortbets.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bigtownchef.with-winting.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bill-attset-c8bc.billnproblem.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"billingoptus-update.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"billowing-surf-1772.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"billybros.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"binancezh.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"binarytrade000.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"biodieseldirect.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200002146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"biodigy.ro"; content:"Host"; http_header; classtype:attempted-recon; sid:200002147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bioenergyevitalite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"birgitkoerner.clickfunnels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bisentechzone.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"biswap-org-exchange.nethram.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bit-cursor.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitbaink.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitcoin-store.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200002154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitcoinsucels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitesize.sg"; content:"Host"; http_header; classtype:attempted-recon; sid:200002156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitfinexbtck.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitfinexday.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitfinexhkpd.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitgert.swap.defi-token.my.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200002160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bithunnb.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitkub.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200002162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitkubcoin.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitmart-trust.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200002164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitpiecrypto.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitpieex.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitte.modimyk.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bitter-term-08e1.masao.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"biupeco.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bjoska-inv.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bjoska-inv.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bjoska-invests.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bjoska-invests.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"black-bonus-a22b.greensandersss.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"black-ofertasmagalu.ntdll.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blackshaw-0utlook-datastorage.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blackshaw-0utlook-datastorage.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blerecovery.22web.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blessingcircles.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200002179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blizzardlogin-us.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bloccooperazionemps.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blog.sjk.co.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200002182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blowfish-ltd.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200002183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"blswap-exchanqe.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bluelakesgoldandsilver.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bmqvzejoon.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bn01928712.ultimatefreehost.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200002187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnamhdiahhdiaondha10.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnamhdiahhdiaondha11.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnamhdiahhdiaondha2.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnamhdiahhdiaondha2.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnamhdiahhdiaondha3.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnamhdiahhdiaondha3.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnamhdiahhdiaondha4.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnamhdiahhdiaondha4.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnamhdiahhdiaondha6.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnamhdiahhdiaondha6.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnamhdiahhdiaondha7.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnamhdiahhdiaondha9.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnb-pancake.finance"; content:"Host"; http_header; classtype:attempted-recon; sid:200002200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnb-pancake.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnconacional.odoo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bncontacto00982.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200002203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bncre.odoo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bncrfiicr.x10.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200002205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnjmbjghgjhghg.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnprelationcara.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bnprelationcara.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"boatekantokente.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200002209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"boefree.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"boehler-trading.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bogalerts.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bogdonovlerer.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bohioconsultores.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bokgabanesolutions.co.za"; content:"Host"; http_header; classtype:attempted-recon; sid:200002215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bold-flower-99ee.pontufbksd.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"boldd.martobang.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"boldensoapco.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bombcripto-game-cv.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bonolle.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bonsaitopics.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"borderlessminders.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"boredapeyachtclub.special-mint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"borma.co.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200002224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bostoncommercialdoor.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"botboun-b5e400.ingress-erytho.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200002226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"botecodomanolo.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"boxdrop.onedrive0001.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"boxypty.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bp.swany.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200002230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bradesco.netsuporte.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bradescoempresas.bankto.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200002232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brainytoysg.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brandsoutlet.qa"; content:"Host"; http_header; classtype:attempted-recon; sid:200002234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bridgecr.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200002235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brightwisecleaning.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"broad-poetry-0748.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"broad-violet-b788.wesmoded.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brohgsebroysh.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200002239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"broke.bibirpergikedanaubuatan.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooks-forrunning.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooks-move.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooks-ooke.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooks-runfarther.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooks-xsbdyugd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooks-xsdaodab.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooks-xsdauofc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooks1914.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooksair.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooksdiscount.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooksfactoryoutlets.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooksforsports.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooksghost13sale.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brookshome.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooksmajor.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooksnewmethod.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooksnewsports.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooksprime.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooksrunningonline.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brooksrunshoeshopping.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brookssoft.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brt-it.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brt-it.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bruceandrewsdesign.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"brunetaw.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bscpad.com.pe"; content:"Host"; http_header; classtype:attempted-recon; sid:200002266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bsnshlp.sprtacn.scrthlp.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bsssc.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200002268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bswap-finance.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bsxgju.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bsxzid.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200002271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bt-101131.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bt-102181webmail.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bt-102263.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bt-103029.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bt-107992.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bt-108413.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bt-108902.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bt-billi.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bt-billingpayment-3d7138.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bt-billingpayment-fa4cff.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bt-email-login-107469.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bt-home-103400.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bt-internet-102829.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bt-internet-102860.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bt-internet-106953.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200002286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bt-internet-108.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bt-intternet-107.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bt-page-jhghjh.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bt-page.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bt.my-style.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200002291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btbusinessbilling.wordpress.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btbusinesscommunication.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btbusinesscommunicationapp.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btcexet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btconnect-109798.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200002296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btconnect-1204e7.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btconnect-232870.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btconnect-2bd0da.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btconnect-3f1489.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btconnect-519eb6.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btconnect-59136f.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btconnect-8c4034.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btconnect-8f2adb.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btconnect-953e69.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btconnect-cd746a.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btconnect-d5ab9a.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btconnect-d68189.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btconnect-de859e.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btconnect-f60683.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btconnect-f73b46.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btconnect-ffada0.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btfdn.ly4yanr.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bthomepage36ycp.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btinternet-101374.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btinternet-109970.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btinternethomepage101832.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btlogintarget5329962535283621.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btlyrgh.mfs.gg"; content:"Host"; http_header; classtype:attempted-recon; sid:200002319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btopenwrld-104914.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btsei.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200002321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btserver200.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btserver222.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btservice221.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"btstelecommunication-7726651.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bubblegooseballers.sol-mints.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bukidnonmockpolls.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bund-de.lojaintegrada.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200002328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"buralenergiasolar.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"busanopen.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"butlernews.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200002331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"buyfbcomments.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bvgf.tgsamvi.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwerc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.acseng.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.avyznec.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.azfeeur.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.cdbmrci.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.cdzzcdc.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.ctvakef.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.cxppysr.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.dcepobe.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.dgupcva.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.djrqths.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.douyincultures.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.dtzunor.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.eqgkesj.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.fjijrrq.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.galaart.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.gcntjjl.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.gokpbmz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.gxctvgq.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.herggwo.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.hjgpamz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.hpslswe.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.iqxsoit.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.itiamyu.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.kmjepam.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.kyetvyz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.liushiweitest.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.lqyinmj.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.mwxcijr.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.nbkoywi.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.njckppb.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.nleinse.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.nomvahd.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.nopqcvg.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.nrgtrki.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.oftoskk.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.omgdzhl.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.pdafsqb.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.pkkyajp.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.pmohain.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.pqtxojm.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.qhuzjzp.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.qhzgxia.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.qrbhfsl.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.quimjik.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.rkcrm.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.rkqolwi.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.rpdyyy.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.rzizen.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.saflubv.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.tcdafgd.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.teheiiw.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.totdata.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.tvvpokx.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.ultzorm.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.vsmqvbk.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.vunijno.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.wigiyak.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.xajnhog.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.xmfloiv.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.ysjedcx.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.zknhftp.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.znderzq.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"bwut-au-pay.zxmtwso.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"byjujoy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"byringenieros.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"c.curiousmorty.be"; content:"Host"; http_header; classtype:attempted-recon; sid:200002400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"c.loveawaits.be"; content:"Host"; http_header; classtype:attempted-recon; sid:200002401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"c.mail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"c0mfimationp4635supp0rtlive.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200002403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"c1hbq274.caspio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"c2dc5b99.chgmar.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"c2dcw069.caspio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"c2dcy170.caspio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"c2hch255.caspio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"c2l2c.osmlprepod.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200002409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"c6ebv708.caspio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cabanacotulariesului.ro"; content:"Host"; http_header; classtype:attempted-recon; sid:200002411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cabpe.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200002412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cache.nebula.phx3.secureserver.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200002413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cadastros.swedencentral.cloudapp.azure.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caeng.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caixabr.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200002416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caixainfos.cargo.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200002417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caixaregularize.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caixaseguradora.quadientcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cajaarequipa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cajabanrural.negocio.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200002421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cajapiurape.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cajarequipaserv.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"calgaryren234tlistwca.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200002424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"calm-grass-8770.tropicstarsfd2299.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"calm-lab-e74a.cattaleya76.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"calstateedu.securevdr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"camachotime.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"canadavisitisrael.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"canakkalecephesi.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"canaleinfoseure-com.preview-domain.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"candilandproperties.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caochuong.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"capacitacionserprof.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200002434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"capitalitary.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200002435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"captchav2test.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200002436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caracasmateriais.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"carinabeger.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"carinabegerconsulting.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"carlos.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200002440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"carpediemxp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"carriedawayproductions.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cartoriocotrim.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200002443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cas-polygon.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"casadoborracheiroxx.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"casadoprobiotico.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200002446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"casanaturalle.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"case225085-coinbase-com.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"casebynavi.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caseid4785055283customerservice.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"castromunicipio.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200002451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cateringfoodanddrinksupplies777.business.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200002452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"catus.cat"; content:"Host"; http_header; classtype:attempted-recon; sid:200002453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cawiji.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"caycos.beispielseite-wmka.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200002455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cbhou91px.fiswebdv.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200002456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cbskateshoop.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cbxupbx.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cc10992.tmweb.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200002459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ccjrlaw.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cdn-32965.airbnb-onelogin.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cef8vwt7y9h.typeform.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"certcredit.intesasp.one"; content:"Host"; http_header; classtype:attempted-recon; sid:200002463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"certificadosgobmx.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"certificazioneappdispositivo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cf5233ed.sibforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cflaxii.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cfluyrkeez1rfsadmrm.qwo231sdx.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200002468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cftechno.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200002469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ch-328328328832.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ch-483828832.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chain-connector.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chain-node.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chainofchanges.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chainswap-ecomi.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chakmarch21.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200002476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chalkerabeat.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"challengepkd.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chamber.lankapanel.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200002479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chambertest1.lankapanel.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200002480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chancey.byethost31.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chase-help-support-locked.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chase-onlinehelp.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chasebank.dressica.pk"; content:"Host"; http_header; classtype:attempted-recon; sid:200002484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chasecertificatesusigon.bill48408mailfonycom.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"check-status-31f89.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"check-status-31f89.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checkmynewphotos.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail25.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail25.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail26.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail26.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail27.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail27.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail28.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail28.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail29.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail29.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail30.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail30.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail31.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail31.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail32.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail32.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail33.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail33.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail34.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail34.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail35.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail35.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail36.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"checksweetmail36.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chefshailendra.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200002513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chiddingstonenursery.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200002514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chihealthsolutions.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chikkuthomas.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"childhelpline.org.kh"; content:"Host"; http_header; classtype:attempted-recon; sid:200002517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"china-gear.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"china-metamask.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200002519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chinmayavidyalayarspuram.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chiragrajoria.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chloejanssen.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"choicemines-shareddrives-0utl00k.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chois.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200002524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chokieubao.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chronokenesis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"churchconnection.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"chutlincrapo.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ci08806.tmweb.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200002529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ci18200.tmweb.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200002530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ci33579.tmweb.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200002531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cibtxdvmcm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cicdmdwlbw.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cicdmdwlbw.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cicloamatore.blog"; content:"Host"; http_header; classtype:attempted-recon; sid:200002535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cielegwwq.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cimeronline.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cimeronline.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cimeronlineiadesistemi.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cintasejatidrink.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cirrilla-stripe-form.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cirrilla-stripe-form.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cisteodpady.cz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"citizenbankpendingholds.dynvpn.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200002544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"citizens-auth93verify.qbusinessmagazine.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"citizensbank3.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"citiznsbank-na-ro35.jkub.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"citlzen0nlinesecure.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"citulje-pomeni.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"city-index.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"city-of-jazz.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200002551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"citz-sms.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200002552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.coinappprotocol.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200002553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claim.redundancy-payments.org.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200002554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claimff.lanjutkan-disini.my.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200002555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claro-link.brsafe.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200002556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"classiceyewear.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200002557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"claus.bz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cleargalaxy.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200002559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clearwaterairbnb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clearwatercleaners.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clef-departementale.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clef-departementale.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clic.ae"; content:"Host"; http_header; classtype:attempted-recon; sid:200002564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clicklo.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200002565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"client-aruba.inproseal-kugellagertechnik.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200002566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"client.ogivart.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200002567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clientarea-aruba.dontrepl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clientarea-aruba.koerte-apotheke.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200002569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clienteperfil.bradapp.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200002570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clientflixbe.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clienti.accesso.sicuro.youthnest.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200002572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clientotbe.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clients.devtux.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clik.rip"; content:"Host"; http_header; classtype:attempted-recon; sid:200002575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"climatefinance.go.ug"; content:"Host"; http_header; classtype:attempted-recon; sid:200002576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clockurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clone-7473c.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"closingdocs9480.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloud-based-shared.line-assets.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloud-owa-cyncrons.abeuac.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloud-preview-shared.auth-sahidoc.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloud-publish-document.drop-documentts.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloud-share-file-drive.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloud-share-file-drive.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloud-shared-folder.preg-remit.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloud-storage.files-recruitments.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloud.onlineapp.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200002588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloud.pgmypaznz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloud102.hostgator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clouddoc-authorize.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloudi.sitea.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cloudshare.at"; content:"Host"; http_header; classtype:attempted-recon; sid:200002593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clt1432536.bmetrack.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"clubeamigosdopedrosegundo.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200002595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cm36756.tmweb.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200002596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cmkcnails.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200002597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cn05985.tmweb.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200002598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cncdistribution.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cner283829.odoo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cnfrmacn.hprusak.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cnn-cameroon-news-d6b70.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cnn-cameroon-news-d6b70.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cnntvpage.eoldal.hu"; content:"Host"; http_header; classtype:attempted-recon; sid:200002604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cny-shopee.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cnylcpqppp.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"co-d.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200002607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"co-il.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coastgymco.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coastgymco.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200002610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coba.tabalongkab.go.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200002611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cobbeco.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"code-douanes.chouaibi-developer.tn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"codepasta.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coelholealadvg.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coffeenovel.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coin98n.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coinbazer.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coindel-btc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coingecko.nl"; content:"Host"; http_header; classtype:attempted-recon; sid:200002620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coinneptune.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coinpayu-adres.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coinssolutionrectification.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coinsxek.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cointechsolutionsmartconnect.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coinwin.vip"; content:"Host"; http_header; classtype:attempted-recon; sid:200002626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coiognline.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200002627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coirbazaar.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coirbazaar.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200002629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"colcentralnew.procesardatos.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cold-frog-0180.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cold-king-e857.marilyn.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"colinngcy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"collablandconnect.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200002634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"collablanod.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200002635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"collegiatesportsnetwork.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200002636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"colmenaradio.com.ar"; content:"Host"; http_header; classtype:attempted-recon; sid:200002637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"comfuyer.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"comm-cancel.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"commbank.logonasx.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"commeres.cluster007.ovh.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200002641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"commerzbank-phototan76z2.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"commerzbank-phototan76z2.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"communauteaserm.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"competitiveindia.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200002645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"complementosicop.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"completecustomcleaningonline.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"compratodousa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"comprind.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200002649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"compte-orange16.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"compuclon.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"comunadebarrancas.com.ar"; content:"Host"; http_header; classtype:attempted-recon; sid:200002652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"comunidademasculina.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"concourstirageausort-leboncoiin.gq"; content:"Host"; http_header; classtype:attempted-recon; sid:200002654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"condigit.sdr.sg"; content:"Host"; http_header; classtype:attempted-recon; sid:200002655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"conf.chuuu.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"confirmaciondecuenta-c30e.czemarkojo.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"confirmfalabeco.x10.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200002658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"confitmationsidentityspages.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200002659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connect-verify.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200002660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connectcentral.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connectclient.wonstasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"connectthewallet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"consent.clarosgvas.mobicare.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200002664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"considerpublisher.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"consultafacil24horas.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"contabilidaderabello.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200002667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"contact-noreply003-my-cheetah-website-1.cheetah.builderall.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"continentalproducts.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"continuehomeservice-20083051532.development.catalystserverless.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200002670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"controlpanel00180722.server1.trinchera.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"convalidanumero.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cooeduc.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200002673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coojoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cookscraps.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cool-moon-9292.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"copyright-helpcenter39257014.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coradecora.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200002678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cordertradellc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"core.pdf-asset.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"corporhmgs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"corporhonline.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200002682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"correctionwallet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"corroes-orden-b58094.ingress-earth.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200002684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cosgtradeex.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cottonwooddentalg.nimbusweb.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200002686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"courage-to-speak.my.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200002687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"courtcase.co.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200002688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"coziathome.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cp-10.whb.tempwebhost.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200002690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cp.digitalprocurements.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200002691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cpanel10wh.bkk1.cloud.z.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cpfruits-storage-0utl00k.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cphamembers.co.za"; content:"Host"; http_header; classtype:attempted-recon; sid:200002694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cqmuco.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cqmuco4afa.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cranstonfamilyclinic.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crazy-taxi.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200002698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crazycheapbride.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"creaccion.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200002700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"create-appeal-58199.herokuapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"create-appeal-58200.herokuapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"create-appeal-58201.herokuapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"create-appeal-89917.herokuapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"create-appeal-89918.herokuapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"create-appeal-89919.herokuapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"create-appeal-89920.herokuapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"credem-app.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200002708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"creditagricole-sudrhonealpes.blogspot.ba"; content:"Host"; http_header; classtype:attempted-recon; sid:200002709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"creditagricole-sudrhonealpes.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"creditagricole-sudrhonealpes.blogspot.ro"; content:"Host"; http_header; classtype:attempted-recon; sid:200002711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"creditagricole.quachnham.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"creditdunord-session.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"creditdunord-session.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"creditiperhabbogratissicuro100.blogspot.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200002715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"creditsuisse.bluproducts.com.py"; content:"Host"; http_header; classtype:attempted-recon; sid:200002716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cricutcomregister.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"criticalcarevizag.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crm.epochfinancialus.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cromexa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cropcity.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200002721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"crossoverbrazil.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cryptoassetrecovery.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cryptocar.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cryptocarsme.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cryptocarspro.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cryptocoinexchanges.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200002727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cryptonvest.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cryptopanel.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200002729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cryptoplanes.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"csdd.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"csgofloat.com.cm"; content:"Host"; http_header; classtype:attempted-recon; sid:200002732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"csgofloat.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200002733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"csgoprofile.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200002734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cshonest.cam"; content:"Host"; http_header; classtype:attempted-recon; sid:200002735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ctzn-cf26b.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ctzn-cf26b.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cubbychase5k10k.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cubex-mint-dapp.herokuapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cuentasfreefire.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200002740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cult1v4t10n-3xp4ns10n.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cumberland-shareddrives-0utl00k.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cumberland-shareddrives-0utl00k.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cupo-activacion.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cupo-activacion.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cupo-clientes-cmr.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cupo-clientes-cmr.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cupo-cmr.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"curly-field-bd79.wareareto.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"curly-paper-7426.m-2-31.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"curly-wave-9189.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"currentlyatt-101843.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200002752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"curtiskennedy.miloyu.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"curtismscaparrotti03.mfs.gg"; content:"Host"; http_header; classtype:attempted-recon; sid:200002754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"customde-supported24.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200002755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"customer-p.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"customer-p.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cuttermachine.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cvaklhre34kj.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200002759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cvsr1.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cw58093.tmweb.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200002761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cwar9.enviodecontrato.digital"; content:"Host"; http_header; classtype:attempted-recon; sid:200002762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cwbwka.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cwbwka.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cwsj.vulpize.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cwtx2-syaaa-aaaad-qct7q-cai.raw.ic0.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cxzvqahsoe.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"cybergtx.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"czvon.4fan.cz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"d.app01988.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"d.app95789.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"d.ciney.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"d.edgecryptobf.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"d.jxted.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"d.oftde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"d2aae6a6.srvr-cloudmail-srvr675eu6r.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"d2kyz7.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"daappnode.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200002778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dacetnroj-gemes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dadgarnia.ir"; content:"Host"; http_header; classtype:attempted-recon; sid:200002780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"daiichi-gakki.co.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200002781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dainikjeevan.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"damp-dawn-51e1.nicholasa.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"damp-f43e.recovery-page-secur.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dangol-v2.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dapaiduo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dapp-pool.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200002787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dapp.activationaccess.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dapp.busta.gg"; content:"Host"; http_header; classtype:attempted-recon; sid:200002789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dappai.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200002790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dappauto.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200002791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dappbuilder.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dapplinksync.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dappnetsync.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dapps-accesstool.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dapps-live.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dapps-rectificate.com.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dapps-rewards.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dappschainencrypt.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dappssynch.win"; content:"Host"; http_header; classtype:attempted-recon; sid:200002800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dappstechlink.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dappsync.nl"; content:"Host"; http_header; classtype:attempted-recon; sid:200002802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dappwallet-connect.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dar.kupabaruak.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dark-scene-db47.gazbor.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"darkball.com.global.prod.fastly.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200002806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dashboard.marketgriddev.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"datafile-shared-outl00k-folders.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"datafile-shared-outl00k-folders.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dawn-river-3b54.marylands.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dawn-shadow-6508.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dawno.ciwumugiasda.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"daycoval.contrato.srv.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200002813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"daycoval.facildepagar.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200002814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"daytrading-wallet.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200002815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"db258db2-ee63-414e-99de-c9a17a21cbf4.id.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dbb.vashonlove.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dchj7rjndg.medicinaclinicaysocial.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dcobonafrr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dd90001.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"de22c9kukppr.clickfunnels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"deborahholland.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200002822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"decenlretends.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"decentrskal-games-on.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"decrocheur.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ded5896.inmotionhosting.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"deferiasnorn.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200002827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"defi-aavev3.cloud"; content:"Host"; http_header; classtype:attempted-recon; sid:200002828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"defi-aavev3.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200002829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"defi-aavev3.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200002830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"defi-go.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200002831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"defiblockchain-node.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"deficoinresolve.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200002833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"defilo.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"defiomega.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"deingiode2.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"deintiershop.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dejpaad.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"delezhen.mashalezhen.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"delhiescort69.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"delicate-bonus-7166.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"delicate-bush-0904.rcvrypahsajk.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"delixx-s-school-84c0.thinkific.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"demarch22.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200002844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"demento.vn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"demo.360degreeinfo.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200002846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"demo.bradescocontrol.vertitecnologia.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200002847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"demo.giamso.com.sg"; content:"Host"; http_header; classtype:attempted-recon; sid:200002848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"demo.webnappmaker.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200002849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"demo2.cloudwp.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"demo2u.vip"; content:"Host"; http_header; classtype:attempted-recon; sid:200002851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"demovp.cruisesmekongriver.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200002852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"denkairhabfga1.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"denkairhabfga10.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"denkairhabfga10.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"denkairhabfga11.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"denkairhabfga12.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"denkairhabfga12.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"denkairhabfga2.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"denkairhabfga3.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"denkairhabfga4.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"denkairhabfga6.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"denkairhabfga8.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"depinfo.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200002864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"desarrolloturisticopartidordelsol.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"desejoourocard.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200002866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"desemjuniomovil2022.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"deskorganize.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"desplugado.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"detailurp.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200002870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"deutcher.easy.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"deutschepost.paymentservices.com.do"; content:"Host"; http_header; classtype:attempted-recon; sid:200002872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev-bn465fr.pantheonsite.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev-certicodeactivation.pantheonsite.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev-dereick4656.pantheonsite.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev-mabanque-bnpparibas.pantheonsite.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev-partner.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200002877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev-tyuj.pantheonsite.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev.technotackle.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev.yasglobal.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev5924.dxxsgb6hsq3ex.amplifyapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev7029.dxxsgb6hsq3ex.amplifyapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dev8082.dbu1maxjpz13n.amplifyapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"devweb-config.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dfasju.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dfcsa56.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dffkjbdvkdfkcxdfvcjhxdfdg.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dffs-drsfer-ftreeryt.agilecrm.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dfscv.ncauayh.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200002889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dftojc.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dgfoodsnet.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dgthyrdthrds.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200002892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dgu9g3a2kzqx2.cloudfront.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200002893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dgw.soundestlink.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dhanushr24.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200002895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dhl.finish-order.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200002896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dhlparcel.sps-ocs.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200002897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dhnsm.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"diasporasharks.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"diasrasafricain.diasporasafricaines.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dicantrelend.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dicsord-nitro-airdrop.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200002902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dicsrods-eglfts.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"die-post-swiss-id-19782635812.psd2any.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"difimining.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"digeesell.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"digiboxtest.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"digital.mps.controllodianagrafici.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200002908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"digitalareaweb.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200002909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"digitaleportaleweb.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200002910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"digitallyjustified.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"digitalmps-info.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"digiwebsol.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200002913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dignityhomecaresadobefilefaxdocument.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"diianadu9.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dilscordilgilb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dilscordilgilw.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dilscordilgilx.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dimasffbrasil.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"direct.smbc.co.jp.jcgkjs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"direct.smbc.co.jp.jcltkl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"direct.smbc.co.jp.njpxyl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"directiongeneraledesfinances-p.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"directnewszone.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"direx.is-great.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200002925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dirgold.easy.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"discipleshipmovement.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"discojd-gift.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200002928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"discorcl-drop.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200002929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"discord-free-nitro.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"discord-information-acc.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200002931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"discordclients.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"discordl-gifts.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200002933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"discordn-gift.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200002934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"discords-gifti.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200002935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"discordtrackers.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"discordverify.gq"; content:"Host"; http_header; classtype:attempted-recon; sid:200002937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"discoverdhaslkcxfinity1.560f866578.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dispositivo-caixa-seguro.x10.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200002939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"distinctivei.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"divino.zxinomoiszer.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"djfdolblis.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"djmishanclub.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200002943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"djt.ca"; content:"Host"; http_header; classtype:attempted-recon; sid:200002944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"djurzwgtbx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dkb-daten.act-or.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200002946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dkb-kunden.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200002947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dkb-kundenservice.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dkb.login.info.20-90-212-107.cprapid.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dkksilaban.helpprotections.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dkksitamjuntakk.martulangsore.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dkyivpunbz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dl.9xu.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dlbmac.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dlfmgbyktz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200002955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dlhdeliveryparcele.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200002956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dlscold-gift.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200002957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dlscords.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200002958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dlsrcod-gifts.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200002959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dm2.opq.pa-tarutung.go.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200002960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dmdecors.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dnthost-b3ae9.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"doanmnmmmmbnmdffd.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"doc001.onedrive0001.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"doccusend.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"docdrive01060authorizesharingfile.onmicrosoft365.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"doclab-console-auth.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"doclab-console-auth.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"docrefrenceadmin.s3.us-west-2.amazonaws.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"docs.revv.so"; content:"Host"; http_header; classtype:attempted-recon; sid:200002970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"docs.risingforcenft.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"docsharex-authorize.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"docsharex-authorize.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"doctor-holz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document-623ad.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document-folder.chat-verify.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document-folder.ownyuguestyu.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document-folder.shared-reconnecting.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document-june.mature-auth.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document-private.direct-sustutelue.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document-product.rototetiined.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document-progress-asset.retupamyte.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document-project-june.voicee-love.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document-project.secure-count.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document-shared.datings-prev.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document-update-progress.shared-filees.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document.folder-console-shared.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document.lates-proposale.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document.project-shared-adobe.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"document.storages-clouds.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"documentoprotetto.filedicondivisione-909524fb9aa348b230295a2b7a842c21.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"documents.projects-june.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"documents.uvzcknthvfffqjzakuxgdrnthu.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"docusign.mslive.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200002994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"docusignredtail.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dofuspoulesnoobs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"doknirifyi.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dokument-ua.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200002998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dolphin-app-wzr5x.ondigitalocean.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200002999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dolunaytravel.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator100.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator105.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator105.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator106.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator113.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator114.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator115.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator117.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator122.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator123.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator123.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator124.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator124.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator128.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator13.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator13.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator137.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator141.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator142.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator147.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator152.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator152.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator153.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator154.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator156.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator159.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator159.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator16.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator162.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator162.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator163.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator164.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator164.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator168.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator170.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator175.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator175.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator177.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator179.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator180.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator184.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator185.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator188.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator189.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator195.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator199.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator199.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator22.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator25.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator25.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator3.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator30.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator30.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator33.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator40.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator40.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator41.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator43.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator44.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator44.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator47.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator49.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator5.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator5.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator50.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator6.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator6.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator64.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator65.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator70.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator78.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator79.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator82.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator85.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator86.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator88.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator89.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator9.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator92.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator93.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator93.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator96.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator97.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domain-authenticator98.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domaincontroller.pmeimg.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200003085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domaindkbservize2022.2ix.at"; content:"Host"; http_header; classtype:attempted-recon; sid:200003086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg1.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg1.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg10.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg10.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg12.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg12.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg15.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg15.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg16.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg16.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg17.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg17.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg19.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg19.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg2.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg2.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg20.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg20.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg21.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg21.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg22.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg22.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg23.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg23.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg24.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg24.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg25.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg25.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg27.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg27.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg28.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg28.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg29.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg29.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg3.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg3.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg30.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg30.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg31.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg31.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg32.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg32.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg33.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg33.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg34.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg34.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg35.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg35.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg4.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg4.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg6.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg6.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg7.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg7.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg8.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domappcheckomeg8.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domesmarketing.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"domotec.com.uy"; content:"Host"; http_header; classtype:attempted-recon; sid:200003144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"doocuandsignapp.azurewebsites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200003145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"doodles.mints-link.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dorchesterwealth-0utlook-datastorage.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dorchesterwealth-0utlook-datastorage.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dorchestrwealth-0utlook-datastorage.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dorchestrwealth-0utlook-datastorage.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dotalink.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"double-minded-organ.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dowaba-s2dhl.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"downloadquickbook.ocafghan.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dpcpl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dpd-redelivery-uk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dpfko-inv.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dpmasdaskj.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dqmfjlbfxa.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"drainerlab.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"drbazzpinx.topijerami.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"drerrqpcco.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"drive-file-device-local-disk.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"drive-file-device-local-disk.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"drive.dataexpertservices.hu"; content:"Host"; http_header; classtype:attempted-recon; sid:200003165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"driveequitypartners.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"droits.typeform.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"drpertmac.co.za"; content:"Host"; http_header; classtype:attempted-recon; sid:200003168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dry-shape-0bbc.sophia-pipefittinghtxd7833.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dry-union-280f.diianekalll.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dry-violet-309b.project-pdf-assets.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dsbfinancialservice.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dsfcvds.wmcscc.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dsgcbeonline.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dskuk.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dtaparelsltd.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dtcpledges.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"duahatii.topijerami.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dunescapital.ae"; content:"Host"; http_header; classtype:attempted-recon; sid:200003179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"duo-ange.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dutray15.beget.tech"; content:"Host"; http_header; classtype:attempted-recon; sid:200003181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dwedw973.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dwedw985.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dwvgs.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200003184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dxxmmyy.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dxxmmyy.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dynastyclinic.ae"; content:"Host"; http_header; classtype:attempted-recon; sid:200003187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"dyuvstyfawecteraw.blogspot.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200003188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"e-access.cspcorp.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200003189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"e-cassare.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"e-docs-shared-outl00k-folders.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"e-exchanger.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200003192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"e-sport.bti-if.dk"; content:"Host"; http_header; classtype:attempted-recon; sid:200003193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"e1-docs-shared-outl00k-folders.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"e1-docs-shared-outl00k-folders.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"e4ff557e.sso-secure-mail04wtwdw4.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"e4ra.byethost8.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"e5rtfygh.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"e63q45f9h5fr.clickfunnels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eagleeyeapparel.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eaglestar.com.myelf75irfhajtm3egepywelf75irfhajtm3egepywelf75irfhajtm3egepyw.servicecareireland.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ealertsbankofamerica.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200003202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eastlink-web.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ebznxjiywj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ec2-18-212-44-10.compute-1.amazonaws.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eccooutletpolska.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ecngx318.inmotionhosting.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"economic-poet-b50.notion.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ecs-india.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ect-maeiesseoicoi.bpriim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ect-maeiesseoicoi.bqeniz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ect-maeiesseoicoi.cfmuyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ect-maeiesseoicoi.dxuxqd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ect-maeiesseoicoi.dzzeqx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ect-maeiesseoicoi.fckvtk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ect-maeiesseoicoi.flvxkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ect-maeiesseoicoi.gimhld.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ect-maeiesseoicoi.gpghar.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ect-maeiesseoicoi.hlmecj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ect-maeiesseoicoi.ilbsch.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ect-maeiesseoicoi.jxajmg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ect-maeiesseoicoi.kcdhgz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ect-maesisesoeiccoi.ajnesc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ect-maesisesoeiccoi.bonxwz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ect-maesisesoeiccoi.etsffm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ect-maieseicoi.hnekal.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ect-masieseiccoi.clfuxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ect-masieseiccoi.flvxkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ect-masieseiccoi.fttznl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ect-masieseiccoi.hqmwaa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ect-masieseiccoi.irrjrk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"edgecryptood.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200003232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"edgecryptoxt.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"editingthatworks.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"edocuments18032022app-1310252903.cos.na-ashburn.myqcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"edolineexpress.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"edptourworld.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ee-help.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eehzobbana.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eemdme966.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"efad-sa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"efax25042022-webapps1-1311433986.cos.ap-chengdu.myqcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"efgcv.pwhsjvu.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eftpstreasurysignature.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"efxzsz.zgdlyhp.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"egiftpremiumgg.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"egis-dz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"egniol.co.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200003248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ei-coach.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eki-net-update.0857hr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eki-net.world-ekkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eki-netneet.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200003252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ekidata-com.zt5izo.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200003253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ekxxdgbxrp.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ekxxdgbxrp.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"electrocoolhvacr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"electronicanehuen.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elektro-stoeckl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elektroonline.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200003259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elfatnianass.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200003260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elifeofficial.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elitegrades-tutor.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eliteskullsmilsimcwb.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200003263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elitewellnessmd.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ellatinodigital.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elncaptcha1.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elncaptcha10.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elncaptcha14.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elncaptcha3.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elncaptcha4.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elncaptcha5.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elncaptcha8.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elncaptcha9.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elnicaptcha12.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elnicaptcha14.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elnicaptcha15.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elnicaptcha4.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elnicaptcha5.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elnicaptcha6.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elnicaptcha7.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elnicaptcha9.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elnmarch22.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elomo.ro"; content:"Host"; http_header; classtype:attempted-recon; sid:200003283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"elretag.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"email-space-increase06485348596483r3p73436de43.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"email-verifiermailbox1.verification1.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200003286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"email-verifiermailbox3.verification1.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200003287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"email-verifiermailbox4.verification1.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200003288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"email-verifiermailbox5.verification1.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200003289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"email302.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emailbtcom.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emailonedriveab5c802a62d5173498c6fff3674005c8ab5c802a62d5173498.newonemail2.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emailservices-webprovide-41a6.wemovetesting.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emailsettings.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200003294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emailverificationupdate39.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emailverificationupdate82.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emailverificationupdate9.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emailwebaccess.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200003298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emandwest.ca"; content:"Host"; http_header; classtype:attempted-recon; sid:200003299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emirateslogistlcs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emitafacil.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200003301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emlink.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200003302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emmemd99985.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emperes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"employees.momentumgrps.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"empregarbrasil.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200003306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"emprego.projetosparente.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200003307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"empty-rice-4c1a.brian2495.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"empty-river-1774.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200003309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"empty-sky-0112.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200003310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"en-proagro.com.ec"; content:"Host"; http_header; classtype:attempted-recon; sid:200003311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"en.kprfn.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"en.vivuni.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"enbolivia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"encryptaiu.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"encryptbtck.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"encryptdrive.booogle.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200003317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"encrypthkpd.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"encryptodapps.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"energyshop-bitflyer.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"enfin-a457d.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"enfin-a457d.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"engcamp.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"engineeringweek.org.ua"; content:"Host"; http_header; classtype:attempted-recon; sid:200003324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"enjoyapartments.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"enjulio.tumejoropcionesaqui.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"enlinea.consultaenlineafiestaspatrias.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200003327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"enoisdf.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"entra-widiba-eu.preview-domain.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"envirofesttn.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eovdmsziie.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ep-2hv.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"epaypl.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200003333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"epochfinancialus.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"epxglhqycz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"equinixcapitalltd.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"erasff.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"erc20-coin.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200003338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eresnuestroganadorr.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eritreanarchives.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ernestaltan.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ershamshad.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200003342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"erzurumyuzme.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"escvghf.ihzhpnl.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"esfdesentakip.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"esp-ace-de-facturat-ion02-b61603.ingress-baronn.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200003346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"espace-client-facture.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"esperanzabravo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"estimatte3323.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"etatrecharge.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"etc-mieisais.aakphmx.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"etc-mieisais.bsiwvul.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"etc-mieisais.fljizdv.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"etc-mieisais.ptxhge.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"etc-mieisais.szjcwbs.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eth-mining016.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eth-pos.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200003357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eth-waet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eth-wintermute.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200003359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ethbass.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ethbw.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200003361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ethcoindefi.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ethdw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ethereum-16miningarea.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ethereum-18miningarea.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ethereum2pool.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200003366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ethhardfork.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ethhex.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ethjs.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200003369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ethju.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200003370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ethnictrendz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ettoyasqd.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eugnerally-wixsite-com.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eurexdjq.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eurobengal.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"europe-west2-my-project-90086352.cloudfunctions.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200003376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eusamarine.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"event.karateworld.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200003378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"everestmotors.com.np"; content:"Host"; http_header; classtype:attempted-recon; sid:200003379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"everylittlepieceofme.ca"; content:"Host"; http_header; classtype:attempted-recon; sid:200003380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evolbithman.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"evolutionsny.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"examine-growth.dvrlists.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exc.bmtf.com.bd"; content:"Host"; http_header; classtype:attempted-recon; sid:200003384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"excel-cloud-document-2021.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"excelmanagementmali.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exchange4free.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exito-validation.260mb.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200003388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exitoapptuya.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exitopaytuya.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200003390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exitotuyapayfmw.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200003391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exitoytuya.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exitsecutt.260mb.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200003393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exittopagosapp.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200003394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exoddus.azurewebsites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200003395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exodislogin.azurewebsites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200003396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exodus-wallet.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exodusss.azurewebsites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200003398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exodusweb-pro.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exooiduslgjn.azurewebsites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200003400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"expediapartnercentral.solemarnoronha.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200003401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"exploreitalytours.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"extracash.inter.pe.softjonub.ir"; content:"Host"; http_header; classtype:attempted-recon; sid:200003403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"extracloud.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200003404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"extrapreaprobado-4pp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"extrastoors.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200003406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"eyebeyasvda.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ezblox.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ezlinkcloaker.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ezssausage.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"f-trk.track-order2.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"f00228cb.sibforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"f0532684m5n.c1.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200003413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"f2ax5-jqaaa-aaaad-qcutq-cai.ic0.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"f60.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200003415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"f7njfgqhv.qwo231sdx.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200003416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"f9w1lned0ruqblxi6jahwotak.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-accts.pages-recovery.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-love1.lpages.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200003419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facebook-policyform64.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200003420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facenboollogin.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facobook.host20.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200003422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facqrfftfh.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facture-compta.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"facture-compta.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fadsc.qhkuiab.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fadsf.lyqlplh.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"faedcontabilidade.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200003428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"failed-delivery-fee.webstyty.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200003429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"faizankhan0408.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200003430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"falconflutter.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"falling-heart-4057.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200003432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"falling-resonance-9f91.westernroad.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fancy-pine-7418.ach7481982.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fancy-rain-22bf.vakagew948.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fancy-sky-8346.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200003436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fancy.bibirgadangdicipok.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fancyexpeditions.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"faq.nathyslog.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"farconavenue.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fast.for-orders.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fastappsolutions.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fastauth2fa.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fastauth2fa.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"faturadopagueagora.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"faturahojepagahelp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"faturahojesemprepaga.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"faturamasterhiper.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"faturasmasterhyper.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fax-29042022-00512fax-1311615844.cos.ap-nanjing.myqcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fax-doc25042022webfax-1311433986.cos.ap-nanjing.myqcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fax07032022doc1-1310019602.cos.na-siliconvalley.myqcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fax07042022fax498apps58-1310726006.cos.ap-seoul.myqcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"faystrangeatx.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fb-case-id-28031803-fcdc-48af.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fb-pages.proteksion-help.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fb-support-46213.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fb-support-46213.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fb7927.bget.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200003459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fbaccountscase10500511.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fbaccountscase10500511.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fbxlogin.ddns.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200003462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fccfc.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fdasxg.xubbvcs.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fdbfh.znxjcsu.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fdsch.phthkpb.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fdscvm.bcgfctf.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fdscx.guzxevz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fdscx.ooegbms.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fdscx.rmugrut.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fdscx.rssoztq.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fdscx.yfzhsfp.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fdscxn.hctydpa.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fdsfdsgaghadr.fnlsakslk.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200003474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fdsfgb.vzadwxy.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fdsvc.hufvfpo.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fdsxhb.fuqddwf.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fdvbf.vohwjcu.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fdx17.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fe274999.sibforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fecxh.t1cxti5.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fecxn.ibroneg.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"federales.validacionoficial.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fedsc.aimjlvn.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fedsc.jxusmug.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fedsh.udbvbgr.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"feelbons.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"felic3sfiestasperu2022.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"felicids.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200003489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"femmaterparaguay.x10.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200003490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fescxz.obneyyl.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fesxcn.clfmicl.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"feszxv.lebpg03.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fewafcewfe.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ffholdingsenterprise.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fgdcx.htxieeh.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fgdsc.sjxdpiw.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fgdsc.yaqbttn.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fgdscx.vpdqram.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fgdscx.zaonlml.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fgdsv.vrmrbhd.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fgdsxc.jaztfte.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fgdzx.xobicfm.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fgenm-6qaaa-aaaad-qcurq-cai.ic.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200003504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fghdskjhgjhkljg.ihostfull.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fghjr74rhudfguhtfguji.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fgm47k6.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fgrdng.zllquhw.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fgsdcx.zxjfcyt.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fgsdv.pbndxcw.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fgtdsc.ftkelon.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fgvdsm.3v3k20g.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fhbguamreward.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fhn3ow24i8gf-0wrhg0-her-0ghbvn-0ehrg55g.obs.ap-southeast-2.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fiberfurnishings.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fico-secu-re.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ficohsa01.x10.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200003517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ficoshmacofig.x10.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200003518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fidelitybank-ng.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200003519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fightagainstcriminal.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fighting40s.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"file-annual-project.cesfulenter.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"file-connect-shared.loading-chats.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"file-share-drive-folder.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"file-share-drive-folder.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"file-share-login-folder-local.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"file-share-login-folder-local.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"file-shared-cloud.lepoyanecalt.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"file-shared-clouds.data-shared.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"file0z.onedrive0001.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"files-secure-folder.ansimapreg.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"files.landing-invoice.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"files.recloud-shared.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"filex.onedrive0001.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"filex001.onedrive0001.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fileyellowelite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"film.jaheshguilan.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"finalsolutions.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200003538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"financeapp.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200003539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"financeiro-portalpj.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"findpost-uk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"finecoding.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"finequalitysports.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"finfutureonliup.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"finfutureonliup.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fire.martobang.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"firstsourcesbus.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fiverrespana.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fivesplash.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200003549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fixemobileconnectinfoline.justns.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200003550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fixi.rest"; content:"Host"; http_header; classtype:attempted-recon; sid:200003551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fixrecertification.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fixupalltokenwallets.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fjjfjdf.sitey.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200003554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fjmexrxqzt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"flat-9be3.marpuasabentar.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"flat-tree-7a42.julie6462.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"flawlessbeautybyangela.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"flawlessvegan.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"flcancer39-px.rtrk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"flkr66.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"floranostra.hu"; content:"Host"; http_header; classtype:attempted-recon; sid:200003562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"florejackie.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200003563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"floridaglobaltrade.agroavance.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"florisolandcompany.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"flowserve-us.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fluksrv.mycpanel.rs"; content:"Host"; http_header; classtype:attempted-recon; sid:200003567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fluttergirl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"flyairprestige.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fm100pakistan.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fmp.wordpressmlm.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"folder-private.erinlemono.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"folder.verify-files.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fomalitysary.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fontainetree.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"foodtechnology.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200003576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"for-giveaway.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"force5itaulogk3--forc3editaulogk.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200003578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"forcemilperu.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"forextradingtruth.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"form.brassbearbrewing.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"formbuddy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"formez-vous.eligibilite-web.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"forms.formium.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200003584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"formtools.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"formulariocarrefour.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"forscript.midaschange.my.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200003587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"foundlation.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fourstarbrother.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"foyefxv3vly.qwo231sdx.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200003590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fpalpha.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fpgesassistcfmdunlock.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200003592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fragrant-grass-5770.scrtygdjahg.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"francomeoli.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"frankedu.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"frankfurtertsparkasse.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"free-covid-19-stimulus-bonus.nethouse.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200003597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"freedomtg3656.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200003598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"freefantasybook.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"freeliker.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200003600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"freeskins-lelo.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200003601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"freesolana.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"freg-nine.pt"; content:"Host"; http_header; classtype:attempted-recon; sid:200003603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"freij.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"freim-regulation.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200003605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"friday-onlinewallet.dd-dns.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200003606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"friendsofnechockey.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"friss.com.ec"; content:"Host"; http_header; classtype:attempted-recon; sid:200003608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"frosty-lab-d5f8.source0542-mail-docxs.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"frosty-leaf-b2cd.onos.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"frosty-mountain-332d.moldthread7435.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"frosty-violet-0628.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200003612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"frr45l9.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fsdbfg.bzmouii.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fsedfc.glcjzgf.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftazxfm3z2rsn.qwo231sdx.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200003616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftdggz.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftgcds.jvrgind.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftgds.vbsobjw.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftjctmshpt.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftp.cnc.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200003621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftx-ca.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftx-pro-register.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200003623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftx-register-pro.world"; content:"Host"; http_header; classtype:attempted-recon; sid:200003624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftx-register.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200003625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftx-register.website"; content:"Host"; http_header; classtype:attempted-recon; sid:200003626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftx-signup.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200003627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftx.cool"; content:"Host"; http_header; classtype:attempted-recon; sid:200003628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftx.tours"; content:"Host"; http_header; classtype:attempted-recon; sid:200003629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftx012.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftx6.vip"; content:"Host"; http_header; classtype:attempted-recon; sid:200003631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftx666888123ftxapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftx777.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftxakp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftxbic.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftxbonus.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ftxcn.vip"; content:"Host"; http_header; classtype:attempted-recon; sid:200003637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fukpost-fint-uk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"funholidaycrafts.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"funiswap.exchange"; content:"Host"; http_header; classtype:attempted-recon; sid:200003640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"furioustsports.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"furryvengeancefve1.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"futec.futminna.edu.ng"; content:"Host"; http_header; classtype:attempted-recon; sid:200003643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fvwhyvqmxlxc34jgtpp.qwo231sdx.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200003644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fwzf322.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fx164fax08022022fax-1310019602.cos.eu-frankfurt.myqcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fx23032022fx1apps87-1310418193.cos.eu-frankfurt.myqcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fx406543docs4580246-1309906520.cos.eu-frankfurt.myqcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fxclfqziox.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fxhalifax.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fxremitminers.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fxtimetrade247.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fyjsvz.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fyndiqaq.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200003654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fyrozkt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"fzpleeqxtj.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"g-mtcc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"g2gesso.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200003658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gaelstars.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"galiciam.server1.trinchera.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"galiciquebe.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"galsinsights.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"galvin-legal.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"game-defiknidgoms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"game.hicage.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gameshesk14515.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gameshesk14515.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"garena-xacminhtaikhoan.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"garenafreefirebts.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"garettbolles.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gatewaytechitservices.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gatlinburg-cabins-now.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gbhfdr.wzyyxjw.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gbvfd.wqyjoab.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gc.elin.co.za"; content:"Host"; http_header; classtype:attempted-recon; sid:200003675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gcdxb.keyijx.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gcdxb.nthtgjg.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gcdxb.rfppnr.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gcdxb.ruv6loj.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gcdxb.snytpht.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gcdxb.vpdzjvb.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gcdxb.zhizaott.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gdfng.bnx1qdy.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gdfvc.suocpse.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gdfxc.egzfudg.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gdgtllc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gdscx.odgidyh.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gdsxcv.nidiljg.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gefun70870.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"geg.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200003690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gegegeggerhrhrh.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"geionthahjdhna12.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"geionthahjdhna4.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"geionthahjdhna9.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gekkosales.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gemairdrop.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200003696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gemini-00e.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"geminimobimovel.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"genehmigencorner.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"general.general-auth.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"generateethereum.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"genie-alba.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gentl.bibirkumaumeletus.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gerberyapi.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gerenciadorfinancelro.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"germannumpouk49.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"germbcw.hclcsolutions.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gesmaer.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200003708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gesolutionsca.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gestionarcitadaviviendaenlinea.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gestionsigwebchile.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gesundheitsmond.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"get-started-aplication-pagenotification.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200003713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"get-started-aplication-pagenotification.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200003714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"getapps.vip"; content:"Host"; http_header; classtype:attempted-recon; sid:200003715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"getfremlbb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"getlikesfree.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"getme.co.nz"; content:"Host"; http_header; classtype:attempted-recon; sid:200003718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"getmyoffercheck.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200003719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"getrobyte.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"getsubfixrepported.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200003721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"geyrecker.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfcv.ipodmrb.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfcvsx.wqgnlcy.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfcxb.tmexpgf.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfcxd.giepuwt.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfcxs.cqleecs.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfdbv.rpsvmzq.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfdbv.uimcqnm.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfdcbv.ipdwddq.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfdcv.adxmphh.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfdcv.fgadwbf.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfdcv.fvfveju.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfdcv.jsapmfj.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfdcvm.ojimng.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfdcvn.sjqwofi.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfdcvx.dxxbhwy.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfdcvx.zhmyqxb.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfdcx.coeyojz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfdcx.diryulf.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfdcx.fhhzgvy.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfdcx.gixftlh.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfdcx.igbomax.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfdcx.lydynah.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfdcx.rfrizonr.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfdcx.xnpckox.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfdcx.yhriwqb.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfdcxd.pvtfoat.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfdcxd.tqonmdv.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfdcxv.ldijzol.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfdgs.ptyyxva.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfdng.gabn70d.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfdrc.hqzarrc.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfdrvb.sqsfkav.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfdsbv.jbnzcwz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfdsc.3wz0b62.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfdsc.jxtfadt.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfdsc.tovtwnu.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfdsc.wpkvfqz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfdsc.yneuzxu.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfdscv.l8ofkz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfdscx.xhxctwc.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfdsn.dg66vqc.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfdsv.c6w2524.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfdsv.fvhsrge.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfdsv.gouwesv.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfdsv.hedquhf.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfdsv.isjagjw.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfdsv.xovljzz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfdsvc.nlfa1gn.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfdsxc.amyulwz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfdvc.dhndcio.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfdxc.rhsebqi.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfdxc.tlkdsgs.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfdxcn.jgayly.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfdzx.iv2cw.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfgmai13.beget.tech"; content:"Host"; http_header; classtype:attempted-recon; sid:200003777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfhdfr.akwstjc.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfjmh.mged6yj.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gftdrc.cgzw9gy.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gfthc.surveysparrow.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ggaxmxo.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ggffftfhhfft.byethost5.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghafarleather.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghbfdc.rgqcvdf.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghbfde.sccvxvp.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghbfv.cayjuwm.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghdfcv.samtldk.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghdrc.xfdwztn.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghfcv.edxljux.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghfcvf.xafusaw.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghfdc.ashhyri.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghfdc.eimjagn.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghfdc.fzpavuj.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghfdc.gnvrfxo.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghfdc.knuodwq.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghfdc.rombryv.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghfdc.ukubdwz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghfdc.wllbceg.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghfdc.wtsiegw.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghfdcv.vfmsbqw.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghfdcx.nfesto.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghfdcx.rknqudk.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghfdcx.szhwzgu.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghfdr.fnazydl.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghfdrc.10ysh5k.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghfdv.fogggnx.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghfdv.hiqeznh.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghfdv.hrwdmcu.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghfdv.uc0u5wt.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghorana.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ghyt.xatkdhl.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"girls-tube.mobi"; content:"Host"; http_header; classtype:attempted-recon; sid:200003813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"girokonto-dkb.alunnesantacaterina.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200003814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"giter.bwbkqud.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"github.nottong.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"giveaway-darwinia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"giveaway-decentral.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gkrypto.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200003819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"glbxvyp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"glennrothenberg.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"globalpatron.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"globovidrosss.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"glogo.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gloriastolfo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gloriatolentino.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"glsword.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gmgroupllc.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200003828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"go-indies.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"go.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200003830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"go24link.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"godocusign-login.rackapp.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"golabaton.ir"; content:"Host"; http_header; classtype:attempted-recon; sid:200003833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"goldpagafatura.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gomlekistanbul.mbs.ist"; content:"Host"; http_header; classtype:attempted-recon; sid:200003835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gonzaleztransformacion.com.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200003836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"good12345.tripod.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"goodheartedmarketing.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"goodratespecial.com.ng"; content:"Host"; http_header; classtype:attempted-recon; sid:200003839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gooo.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200003840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gopwear.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200003841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gorjessnailz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gpcarautocenter-web-sand-home.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grabillcontactlens.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"graphic-boulder-301015.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"graydovesgrace.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gredcv.cnrdnmq.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"green--dream--6331-on-fleek-co.translate.goog"; content:"Host"; http_header; classtype:attempted-recon; sid:200003848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"green-pine-7fe7.do020.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"greenland.co.mz"; content:"Host"; http_header; classtype:attempted-recon; sid:200003850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"greenlifeconcierge.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"greenvonline.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"greenwayweb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grfdc.qartbcz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gridcraft.perfect-mints.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"groupesuseg.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200003856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grove-5bd0a.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grove-5bd0a.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grupodetrabajo.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200003859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grupoelectorial.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200003860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grupoexitopaya.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200003861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grupofsp.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200003862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grupoosinez.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200003863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gruppbper-com.preview-domain.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grvcb.mwfahek.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"grxdvc.owkqtvr.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gsffreedcr.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gskjmob.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gsmunlockserver.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gsrl90.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gtigrovvs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gtyaner.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gue9qfp4dczvd3ejilxacbr3t.qwo231sdx.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200003873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gulfpos.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200003874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"guprosselecto.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200003875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gurukanth.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"guryngnjjo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gvhjhkguyjgyuguygj-tgjh9diov4181332.codeanyapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gwenet.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"gxa1ij.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.asxpfj.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.b2bxjea.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.biupqoc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.bkwsfdc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.calxwbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.coinbaive.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.cpqyjxi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.croknqp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.cwghjv.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.ephzbuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.eurexsih.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.eurexvky.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200003892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.fxzqpgl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.gefun18732.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.gefun18876.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.gefun36119.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.gefun37352.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.gefun58122.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.gefun68299.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.gefun79595.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.gefun80385.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.gefun93676.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.geuokwj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.gobsaym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.hifly57326.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.hiflyk28075.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.hiflyk28306.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200003907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.hsnhc321.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.hzln019.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.icsdymv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.iutsnap.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.jhafrwo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.jkozclh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.kgoumav.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.kiqhuxf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.kpdwpl785.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.ktcugbx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.lqezvpd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.mhevtwo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.miaycel.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.msjgiht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.mwybeat.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.nbustyr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.noeikxc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.npsltvr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.ntmml5ca.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200003926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.nuvdzkb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.qumrvdi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.rstawxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.rtgbcnq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.smolncx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.somahty.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.srpgyuc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.tdezwyo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.tmaeqcr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.unjadfl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.voktbhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.wcfdzgt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.wqfxkil.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.xgcikoz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.ynbsvhz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.zpefnlr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"h5.zxgiqvb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200003943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"habbocreditosparati.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"habi10100200.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hacof.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hahdaeupdate.es.tl"; content:"Host"; http_header; classtype:attempted-recon; sid:200003947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hakbukcaptcha1.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hakbukcaptcha10.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hakbukcaptcha12.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hakbukcaptcha15.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hakbukcaptcha18.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hakbukcaptcha2.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hakbukcaptcha20.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hakbukcaptcha5.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hakbukmarch22.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200003956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"halaman.zyrosite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"halibotton.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200003958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"handakai.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200003959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hands-that-serve.my.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200003960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"handvina.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hangovertest1.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"happywaffleco.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"harishsakthi.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200003964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"haroldhazard1-wixsite-com.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hassanreddick.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"haunlimited.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200003967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"havas.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200003968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"havasgroup.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200003969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hayleymichelle.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200003970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hazelsecurity.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hdcxd.zpcaofe.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hdfcx.zwztxhz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200003973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hdrive118147933264.blob.core.windows.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200003974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hdrive173524723527.blob.core.windows.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200003975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"healthatlums.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"heartflo.health"; content:"Host"; http_header; classtype:attempted-recon; sid:200003977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hebebbe.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200003978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hechoparati.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200003979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hechosoloparati.byethost3.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hedefpanel.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200003981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"heinthu1.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200003982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hellenic-postbank.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hello-partuculiares-b5eae9.ingress-comporellon.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200003984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"help-ad.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"help-ad.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"help-control-access.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"help-vystarcu.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"help.insecur.saftyalert.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"help.validation-page.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"helppageid863144411111.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200003991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hendaklahengkau.martulangsore.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200003992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"henry.tiny.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200003993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hertce.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200003994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hertzclubdk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hervochapiteaux.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"heseemscool.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hex-dao.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200003998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"heychefy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200003999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfcvd.npnxrtg.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfcvg.hfmfvng.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfcxd.xtaiyrh.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfcxdf.dhoffzk.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfcxn.xzizrkj.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdc.ybhxcvx.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdcv.d4e7o2u.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdcv.ikiyakk.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdcv.kkgsxmg.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdcv.kognziw.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdcv.nndsfzu.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdcv.nvuttty.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdcv.rbqeqln.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdcv.rv1df18.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdcv.ujttbim.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdcv.vehodmm.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdcv.xzwddbf.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdcvd.srshvdo.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdcvm.e16bcuz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdcvx.fgozzqd.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdcvx.pgxbikd.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdcx.birenjx.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdcx.bmovfzw.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdcx.bwiatdi.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdcx.d7a4kwy.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdcx.dan0irf.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdcx.deomiic.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdcx.hfokkmz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdcx.idcnpbn.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdcx.kndzkmd.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdcx.m1a64js.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdcx.mcatxcz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdcx.mcrkicx.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdcx.qeqwnzx.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdcx.svgzbsu.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdcx.tzrbsc.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdcx.uosx37x.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdcx.whybcyh.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdcxd.bibijx.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdcxde.ublqiaz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdcxng.beznawi.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdcxs.wuhrrdd.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdgc.vjlgtjp.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdgc.y4dgy0e.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdgv.swtpnvv.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdhtg.xqynmaj.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdnbg.cesheyn.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdrcv.cojd0fn.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdrs.yiwgliw.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdvc.78r7sra.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdvc.cixwvec.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdvc.xnk3azy.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfdvcd.abuaxfi.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgbcv.lwbuudk.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgccv.wn2q8td.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgcv.ehyvjmh.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgcv.ewlaxmi.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgcv.gmuqpic.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgcv.gurbrkx.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgcv.hbmkuth.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgcv.qlgbhho.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgcv.stjvxpn.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgcv.wmoonhl.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgcvd.52g7rj.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgcvd.aizn2.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgcvm.tnewfgp.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgcx.67t7fx4.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgcx.dejaqsu.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgcx.hakwfmq.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgcx.jozxafv.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgcx.pthncsc.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgcxd.hchquqx.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgdc.2ndcaap.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgdc.32zqk6j.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgdc.cfsbvqx.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgdc.ciapbpr.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgdc.douwxrg.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgdc.ggtnvy.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgdc.hueblzd.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgdc.korzbin.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgdc.llnnakk.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgdc.nkvpqyq.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgdc.ptvbykl.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgdc.uillkbz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgdc.yfclgat.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgdcv.9pl3w7n.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgdcv.aizn1.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgdcv.dbvjhny.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgdcv.klrnfwb.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgdcv.oeayeuf.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgdcv.qlptfgg.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgdcv.vusgixj.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgdcx.spsfgtk.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgdcx.ugetbig.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgdh.htomezs.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgdv.grazssz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgdv.jmvfwll.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgdv.lpzsiwt.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgdv.migzpoa.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgdv.ppipp.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgdv.ptazbdu.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgdv.qmcjtzy.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgdv.ryjzgbw.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgdv.tt03n34.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgdv.u8gyzk5.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgdv.voxzbjd.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgdv.wrloeew.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgdvb.ugmpeow.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgngh.r7eef1x.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgv.nztwmji.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgvc.pppisfp.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfgvvc.pvypwrg.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfili.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hftgd.0sjbzv7.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hftgd.hgksyyu.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hftrg.smhqjch.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hfv0w394gf-vhwbe4-pvfghb-w30e4hgv-98h4ergv.obs.ap-southeast-2.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hg5566dh.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hg5566gx.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hgcxd.cloudre.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hgfbv.mjqmcfp.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hgfbv.ncwoxor.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hgfcd.xhohxuw.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hgfcv.hbjshct.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hgfcv.iejyzek.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hgfcv.jcqlirn.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hgfcv.mycnpiq.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hgfcv.vtyugco.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hgfcvc.ahlaooh.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hgfcvd.fwoumxv.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hgfcvd.rslcfho.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hgfdc.iqwqamx.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hgfdcx.rxmawye.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hgfdjhgfdgfdjhytryugfdvbnvc.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hgfdvc.955lxzs.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hgfvc.syydpxy.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hgfvc.yheiwrq.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hghjhkjjgg.vfgjkkhglkl.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hgkjv.ndktzqu.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hgtcx.jivqcre.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hgyf.hnlqjwh.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hiahhfghjrjehs1.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hiahhfghjrjehs10.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hiahhfghjrjehs11.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hiahhfghjrjehs3.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hiahhfghjrjehs4.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hiahhfghjrjehs5.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hiahhfghjrjehs6.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hiahhfghjrjehs6.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hiahhfghjrjehs9.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hidden-mud-9b49.offiice.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hifly01569.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200004151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hifly10365.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200004152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hifly12721.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200004153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hifly21173.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200004154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hifly27702.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200004155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hifly38283.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200004156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hifly57326.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200004157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hifly62556.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200004158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hifly73892.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200004159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hifly85295.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200004160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hifly96975.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200004161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hiflyk27793.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200004162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hiflyk47344.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200004163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hiflyk66656.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200004164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hiflyk70213.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200004165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hillslogistics.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200004166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"himalayansherpa.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200004167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"himbauane.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hindieducation29.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hingehealths.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hiperconsultamaio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hipersexta2m.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hisoftsxwnf.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hitmailreview1.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hitmailreview1.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hitmailreview10.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hitmailreview11.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hitmailreview12.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hitmailreview13.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hitmailreview14.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hitmailreview15.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hitmailreview16.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hitmailreview18.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hitmailreview18.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hitmailreview2.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hitmailreview21.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hitmailreview21.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hitmailreview23.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hitmailreview24.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hitmailreview25.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hitmailreview25.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hitmailreview26.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hitmailreview29.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hitmailreview3.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hitmailreview30.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hitmailreview30.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hitmailreview4.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hitmailreview5.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hitmailreview6.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hitmailreview6.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hitmailreview7.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hitmailreview8.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hitman71hd-wixsite-com.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hitmarch22.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200004204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hj52rs.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjdgfgdh.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200004206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjfcxd.dqryvng.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjfcxn.iupsmfn.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjfg.gpqrpvf.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjfgb.nnwxmib.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjfgb.rrqgqth.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjfgc.2hj8ild.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjfgc.uammiaz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjfgcv.avkyzuq.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjfgcv.dwojueu.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjfgcv.gysujfi.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjfgcv.imlcesh.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjfgcv.kbkflug.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjfgcv.lzgxykd.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjfgcv.mc1uf7d.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjfgcv.muyamzp.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjfgcv.nygingl.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjfgcv.qmdecev.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjfgcv.relvcsh.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjfgcv.ujzldbq.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjfgcv.yczqfds.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjfgcv.zbugwpq.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjfgcx.galtgox.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjfgcx.gdgjeln.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjfgcx.hkbphx0.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjfgcx.qdkskrc.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjfgcx.qdyuafp.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjfgcx.rhzezqi.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjfgd.9i4ddb4.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjfgd.wwrggge.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjfgv.bgyydvf.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjfgv.dessuxq.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjfgv.fpohukj.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjfgv.gyqenvu.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjfgv.lsdsbfa.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjfgv.nzncosw.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjfgv.rjivrai.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjfgv.wlbgczt.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjfgv.ymsgqex.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjfgv.zaonymb.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjfgv.zxfqfcc.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjfgvc.196eaa6.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjfgvc.iliahra.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjfgvc.knxhtmn.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjfgvc.mmvegwg.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjfgvc.mzoohnp.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjfgvc.posxftv.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjfgvc.qfovawj.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjftg.ysdavhe.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjftgcv.aeeftjw.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjftgv.avrmogp.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjftgv.mbirgqc.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjftgv.nrroxzp.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjgcv.hsitpdr.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjgcv.yhkdukg.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjgcx.ojpqxvf.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjgfc.2moxeo1.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjgfc.nmwscxd.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjgfcv.dpfpwde.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjgfcv.uhgejjl.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjgfcv.zruptrp.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjgfcx.luheai.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjhjhgjkhjk.vfgjkkhglkl.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjoyfmdiot.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hjy87hjy87.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hkncfwefhg.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hm-ukrefunds.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hmmm84.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hmseguros.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200004274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hnhft.u.us.openport.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hnn.ph"; content:"Host"; http_header; classtype:attempted-recon; sid:200004276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hofyopurzo.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hoje-registro-solucoes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hoje-temos-solucoes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"holding-energy.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200004280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hollywoodrepublican.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200004281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"homadecook.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"home-zimb.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"home.pgllc.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200004284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"homemade.school"; content:"Host"; http_header; classtype:attempted-recon; sid:200004285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"homemadeclass.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"homemadeclasses.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"homeoffice365login.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"homesupport.org.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200004289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"horizon.dylijowij.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hoshahfd1.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hoshahfd1.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hoshahfd10.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hoshahfd10.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hoshahfd11.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hoshahfd12.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hoshahfd13.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hoshahfd13.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hoshahfd14.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hoshahfd17.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hoshahfd17.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hoshahfd18.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hoshahfd18.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hoshahfd2.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hoshahfd20.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hoshahfd24.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hoshahfd24.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hoshahfd25.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hoshahfd3.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hoshahfd4.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hoshahfd5.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hoshahfd6.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hoshahfd7.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hoshahfd7.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hoshahfd8.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hoshahfd8.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hostnix.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200004317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hotel-pontos.gr"; content:"Host"; http_header; classtype:attempted-recon; sid:200004318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hotelcoronado.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200004319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hotshoot2022.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hounbvc-c7661.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"house18.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200004322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"housebase.hercobuly.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200004323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"houseofscotland.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200004324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hozzbydigitalsolutions.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hpplotters.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200004326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hqofwmbfjo.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hr1.vashonlove.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hrxvgn.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"htcgn.hdutckq.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"htcxf.geswax.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"htdcv.isg7ny2.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"htfgcv.dahmjba.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"htfgv.zdmnnue.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"htir.co.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200004335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"httpeugnerally-wixsite-com.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"httpsielts.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"huangxc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hubinternational-storage-0utl00k.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hubvalidator.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200004340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hulu-com-activate.sitey.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200004341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hulu-hulu-com-activate.sitey.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200004342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hulu.sitey.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200004343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hundgod.my.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200004344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"huntandgo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"huntington-af7d1.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"huntington-af7d1.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"huntington-f04bd.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"huntington-f04bd.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hutoknepper.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200004350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"huynguyen2k.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hvbg.ckpakr.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hw6xhec89k.qwo231sdx.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200004353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hwfo24295.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200004354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hxekc34mlfumxdglcclja.qwo231sdx.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200004355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hycuoppyu103430.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hyfdcv.lpbmebc.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hyfgd.ffpvrvm.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hype-primates-embassy.monkelabs.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200004359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hyutrr.rvwthtt.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"hzln019.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200004361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"i-ask332.dga.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200004362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"i.violationspage.validationspege.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"i9qoaal.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iafhl.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iberostarhotelsresorts.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ibkrk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ibpm.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200004368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ibraibraa170.42web.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iccccri1.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iccu-2fa.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iccu-2fa.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iccu-a.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iccu-vry.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iccu-vry.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"icsconsultant.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200004376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"id-000064updatenow.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"id-64300000-updatenow.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"id-auth-apple.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"id-auth-apple.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"idealcasaloglnadmln.connessioneit.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"idlyservice.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"idobeamolax.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"idpkeaomqm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iepsanjosemiguia.edu.pe"; content:"Host"; http_header; classtype:attempted-recon; sid:200004385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifibybo.cluster028.hosting.ovh.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200004386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifjyliwqhn.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iframejld.avent-media.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200004388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifunsjd1.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifunsjd1.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifunsjd10.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifunsjd10.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifunsjd11.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifunsjd12.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifunsjd13.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifunsjd13.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifunsjd14.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifunsjd14.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifunsjd15.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifunsjd16.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifunsjd17.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifunsjd18.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifunsjd2.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifunsjd2.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifunsjd21.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifunsjd3.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifunsjd4.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifunsjd5.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifunsjd6.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifunsjd7.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifunsjd8.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifunsjd9.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ifunsjd9.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"igotinnovative.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"igsolthermsolar.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ihahdgdjd1.firebaseapp.com#a@b.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ihahdgdjd10.firebaseapp.com#a@b.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ihahdgdjd11.firebaseapp.com#a@b.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ihahdgdjd12.firebaseapp.com#a@b.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ihahdgdjd12.web.app#a@b.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ihahdgdjd13.firebaseapp.com#a@b.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ihahdgdjd15.web.app#a@b.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ihahdgdjd22.firebaseapp.com#a@b.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ihahdgdjd23.firebaseapp.com#a@b.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ihahdgdjd23.web.app#a@b.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ihahdgdjd3.web.app#a@b.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ihahdgdjd5.firebaseapp.com#a@b.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ihahdgdjd9.web.app#a@b.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iheartmotorsports.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ihhvkxxkkx.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iicconsulting.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iij-securedocs.azurefd.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200004432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iiss.edu.pk"; content:"Host"; http_header; classtype:attempted-recon; sid:200004433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ijnqvwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200004434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ikeno-corp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ikko-pkobp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iko-secure.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ilrbdcilvi.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"imb.manantialdebendicion.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"imb4hjefv3.qwo231sdx.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200004440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"imbwaremhd.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"imbwaremhd.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"imeca.com.ve"; content:"Host"; http_header; classtype:attempted-recon; sid:200004443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"imitoken.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200004444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"immersivetech.sg"; content:"Host"; http_header; classtype:attempted-recon; sid:200004445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"imobiliaria-cardinali-com-br.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"importvalidator.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"impotsgouv-france.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"imsj.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"imtokenmart.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inamujer.gob.ve"; content:"Host"; http_header; classtype:attempted-recon; sid:200004451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inchirieri-limuzinebucuresti.ro"; content:"Host"; http_header; classtype:attempted-recon; sid:200004452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"incoming-fax-document.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"indianajons.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"indianastroacademy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"indigoswap.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"indoorleaf.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200004457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inf-webap-mps.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200004458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inflixty.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200004459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"info.dnb.no"; content:"Host"; http_header; classtype:attempted-recon; sid:200004460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"info85.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"infoclient.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200004462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"infompsareaweb.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200004463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"infoportalempsweb.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200004464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"informations.recovery.confiryourpage.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"informationtaxcase.page.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200004466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"infos-novobanco.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"infospacedex.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200004468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ing-banque-be.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ing-banque-be.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ing.usuarios.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200004471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ingaveiculos.creatorlink.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200004472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ingbe-home-6217b.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inghomeindex.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ingnetbe.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ingreestuyaa1463.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200004476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ingreestuyaa212s.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200004477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ingreestuyaa2213.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200004478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ingresar-bancaporinternet-pe.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ingresar-interbank-peru.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ingresar-interbank-peru.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inilpcaslahalf.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200004482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inmobiliariaalfa.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200004483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"innate.es"; content:"Host"; http_header; classtype:attempted-recon; sid:200004484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"innotime.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200004485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"innovation-evotik.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-pl-hid226ks.wniosek182504.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200004487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-pl-hid226ks.wniosek392107.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200004488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-pl-hid226ks.wniosek480673.fun"; content:"Host"; http_header; classtype:attempted-recon; sid:200004489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-pl-hid226ks.wniosek572043.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200004490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-pl-hid226ks.wniosek834729.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200004491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-pl-hid226ks.wniosek987246.tech"; content:"Host"; http_header; classtype:attempted-recon; sid:200004492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-pl-myid271xs.order-id93821.buzz"; content:"Host"; http_header; classtype:attempted-recon; sid:200004493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-pl-myid271xs.pl-dostawa02938.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200004494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-pl-myid271xs.pl-dostawa04927.buzz"; content:"Host"; http_header; classtype:attempted-recon; sid:200004495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-pl-myid271xs.pl-dostawa83291.click"; content:"Host"; http_header; classtype:attempted-recon; sid:200004496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-pl-myid271xs.pl-order03482.beauty"; content:"Host"; http_header; classtype:attempted-recon; sid:200004497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-pl-myid271xs.pl-order83921.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200004498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-pl-myid271xs.pl-order93281.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200004499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-pl-myid271xs.wniosek790438.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200004500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-pl-xz5512.sprawa892341.beauty"; content:"Host"; http_header; classtype:attempted-recon; sid:200004501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-pl-zai.accept8145.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200004502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-polska-cyf.ordernew11010103.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200004503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inpost-rghl.2584902.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200004504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inps-ep.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"int3eractivebrokers.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"inter-bkpromos.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"interactivebrokersx.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"interactivebrokrers.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"interactivebrolkers.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"interadtivebrokers.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"interb.annkonline.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"interbank-ingresa.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"interbank-personas.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"interbank-peru.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"interbankempresahomeweb.gemsaweb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"international-c.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200004517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"internetservicetech.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"interspar.at"; content:"Host"; http_header; classtype:attempted-recon; sid:200004519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"intesasp.one"; content:"Host"; http_header; classtype:attempted-recon; sid:200004520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iogfhgn.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ionos-mein.webmail.de.flick-fix.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200004522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ionos-pending-recovery-mail.glitch.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200004523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ionos.com.ng"; content:"Host"; http_header; classtype:attempted-recon; sid:200004524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ionos.zimapp.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ionroyazz.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iooksrare.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200004527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ip-72-167-45-95.ip.secureserver.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200004528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ipixacademy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iplogger.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200004530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ipvpn055172.netvigator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"iraudzsq.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"irelandsissuesmagazine.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"irs-claim-onlinetax.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"irs-claimtax-managefinancials.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"irs-financial-taxgov.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"irs-gov-my-amanded-tax-return.rina-009.tech"; content:"Host"; http_header; classtype:attempted-recon; sid:200004537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"irs-pay.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200004538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"irs-payeeonline.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200004539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"irsgov.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"irspay.2.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200004541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"irsprofile-taxmanage.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"irvinenursingandrehab-secure-doc.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200004543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"isaacanicama.pe"; content:"Host"; http_header; classtype:attempted-recon; sid:200004544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"isaacwitty.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ishr.cm"; content:"Host"; http_header; classtype:attempted-recon; sid:200004546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"isxykfokg84r.martincaldeyro.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"it-europe564598-com.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"italianswingdanceacademy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itauprotegerapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itauseguranca.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itmse.t-exponent.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itoscop.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itsmdshahin.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"itsweblook.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ivfcentreinindia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"j-reseaupme.cm"; content:"Host"; http_header; classtype:attempted-recon; sid:200004557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"j24mo.app.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200004558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jaccs.smbc-rieirfg.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jacobliston.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jajaja2121.byethost31.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jam-023d.gitlab.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"james8.aidaform.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"janex.ir"; content:"Host"; http_header; classtype:attempted-recon; sid:200004564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jappening.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200004565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jasa-bg-kakon-keman-aj-45676748767.web.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200004566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"javarockingland.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jccmaou.tnihdcl.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jcfvfd.wlwomes.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jckfirs.punctulcentral.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jcvfn.htoqrhm.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jennipricephotography.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jenny-fcc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jensolis.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200004574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jessicaanddani.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jetser-electrical-supply.business.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200004576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jett.gator.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200004577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfbcv.sdzrkzt.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfbfcv.lmn0kdd.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfbvf.gyujqrn.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfbvf.sjgmcnt.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfbvg.ehbguvd.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfcvf.4hcgks7.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfcvf.melqvjk.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfcvf.uctcqf.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfcvf.ukpgnat.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfcvfd.1dfb1b3.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfcvfd.xhibayk.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfcvfdc.vzpsxgu.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfdvj.weckndx.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgbcv.h9ngrb3.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgbf.qrzviks.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgbv.froenhu.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgbv.grkvnnx.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgcv.09bndsz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgcv.2ngemf0.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgcv.4dt9539.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgcv.ahcaghj.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgcv.ajatyln.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgcv.amhlgwk.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgcv.bpvfagf.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgcv.ciorwbj.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgcv.dmvzngq.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgcv.fvfvskh.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgcv.girvcdr.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgcv.hmidhdg.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgcv.hpdxwca.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgcv.hsoasfl.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgcv.jnxhehm.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgcv.jzpggzr.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgcv.kbhrxfz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgcv.kbtenao.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgcv.nqganfx.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgcv.nwtuetw.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgcv.rqrj73e.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgcv.serkmze.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgcv.u9vvm3v.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgcv.uenqkls.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgcv.uenqkls.cn."; content:"Host"; http_header; classtype:attempted-recon; sid:200004619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgcv.ulrwxpc.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgcv.umfibae.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgcv.wo3sm0q.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgcv.wojsawm.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgcv.xkiohxe.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgcv.xydarqw.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgcv.ybkkjtf.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgcv.yepmhxj.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgcv.yiroqiz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgcv.yuijkoh.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgcvd.nl8kku1.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgcvf.juasmve.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgcvf.pmjpqbj.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgcvf.vdciivs.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgcvf.xltzzyz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgcvx.3sveo3h.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgcvx.tudjekp.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgcvxd.duymkts.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgcx.jyighha.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgcx.jzblzha.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgcx.ufrjnly.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgcx.ujcatd.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgfc.q6jp9ob.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgfd.sycwqih.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfghb.djhuuoj.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfghb.hacdrwz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfghb.nimwnwe.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfghc.faphcav.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfghc.jzronqy.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfghcv.avffcvz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfghcv.cgkvmlc.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfghcv.kxfhhbb.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfghcv.lhhdybp.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfghcv.mtcucnq.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfghcv.qwhutqi.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfghcv.w7jy0uj.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfghcv.yqrpzjz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfghv.aedyuoj.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfghv.bvinakn.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfghv.coyzhkd.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfghv.eyuazti.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfghv.jj56prb.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfghv.kfyzasf.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfghv.kwmepft.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfghv.mjmyxpd.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfghv.owwuuxv.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfghv.sfblwhv.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfghv.uxfkqos.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfghv.vznkwsh.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfghv.xsmgwst.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfghvc.gezawqr.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfghvc.xtkwtca.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfghvc.zt88203.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfghy.ewgtgwm.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfghycv.rtcwesx.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgv.asqmxir.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgvb.6eb0pji.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgvb.cjmximh.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgvb.rysfoqk.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgvb.xfnhzzc.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgvbc.vycwlag.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgvbc.ydfxl43.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgvc.6riwo5s.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgvc.emdgjgs.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgvc.gqpdiga.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgvc.hpgviti.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgvc.hrcgpms.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgvc.izmdigp.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgvc.jafonwc.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgvc.ndscjbg.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgvc.nmsbknd.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgvc.opvvqxw.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgvc.oqvaedt.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgvc.pdcziuf.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgvc.pqmyggn.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgvc.vcljzxu.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgvc.znjwjlf.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgvc.ztfyjmc.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgvcb.xbxnnib.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgxc.wpdbqol.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfgyv.pdwoebr.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jflkp.csb.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jftgcv.dujnmtd.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jftgcv.qjqueye.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jftgv.fmndxzk.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jftgvc.osuhyrk.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jfvcf.857yb0a.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jgbvd.afuchgs.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jgfcv.0t822g8.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jgfcv.bjkdyv3.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jgfcv.cqvuuam.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jgfcv.ctronys.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jgfcv.d8wi2wq.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jgfcv.hnziiak.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jgfcv.knklzfh.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jgfcv.oomubdy.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jgfcv.pqgkrxy.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jgfcv.qupiabb.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jgfcv.vkdkbvo.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jgfcv.x64ynea.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jgfcv.yspxjik.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jgfcvf.t3jzmig.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jgfcvf.xhxbxuj.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jgfcvfd.awzvnfs.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jgfv.bvnyjnh.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jgfvc.evlcbqw.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jgfvc.kbcxeyq.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jgfvcb.8a9o5hz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jghbcv.tdnyerf.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jghbf.rndvovi.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jghbv.jirpmvq.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jghbv.tqwqmww.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jghcv.heuymee.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jghcv.kzkqkae.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jghcv.skqcoha.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jghcv.xrpzfxt.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jghcvf.hnkszxu.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jghcvfd.febxlxk.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jghcvx.lstpvcz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jghcvx.yu677q.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jghfgd.czxxyua.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jghjasfxjahxgkvy.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200004741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jghv.lnojmlh.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jghvb.0clf43f.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jghvbc.cgivuui.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jghvc.mvnzjdm.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jghvc.pmeertm.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jghvf.fhlzkuc.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jghxc.nyophth.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jghyv.iezhner.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jgvcf.boacqwz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jgyhbv.cdlafps.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhbfvc.jwuadhk.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhfgb.azxolfc.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhfgbv.xycijya.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhfgcv.wmmnsya.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhfgcx.baixijx.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhfgv.argablw.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhfgv.c5ri0le.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhfgv.eexjsyc.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhfgv.lbfelor.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhfgv.ohydogp.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhfgv.qdwtrys.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhfgv.sqfxxqk.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhfgv.yypxpc.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhfgvc.fwtzywj.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhfgy.hlmbwmk.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhftgv.tfslpkd.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhftv.lxfpncs.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhfty.pu8eo7n.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhfvc.ocintcj.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhgbv.jktecyd.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhgbv.ozciqpa.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhgcv.ihwszli.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhgcvf.unp3tfe.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhgcxd.w2j11k.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhgfv.nzesdlo.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhgrtyoliutry.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhgvc.wszbxxa.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhgvc.x829iyu.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhgvfd.fdeqzm.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhsvalbvs.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200004781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jhytgc.5jec3ub.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jibfbv.hnzhpil.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jinchangwg.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jinzan.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200004785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jio-giga-fiber-scale-repair-service.business.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200004786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jiofiberoffer.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jiofibrebroadband.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jiosell.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jiowinners.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200004790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jkbshfjcn.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jkfghc.yjkrzqy.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jkfghcv.jizamgb.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jkgfhrhvh.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200004794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jkghb.ckujcv.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jkolawnservice.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jltownerg-r-m-o-f-h-allc.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200004797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jlwoodj2.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jnfgh.dxkurd.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jnfgv.wnpbhtt.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"joannschreiber.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"joecamera.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200004802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jolly-sabaa.topijerami.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jordansbooks.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jossois.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jow-japan.or.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200004806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jqdyt6bdshjh77jtol0e1vbyoejeir.qwo231sdx.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200004807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jrurescjeb.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200004808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"juanesteba.xiaopangkj.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200004809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jufgh.volccloud.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jufgh.zfvpluc.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jufgv.fehbjnd.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jugfd.eqqlmvw.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jughb.hjadlyt.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"juialaq1819.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jujubasoftware.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"juliegr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jumelterracebooks.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"june.document-project-list.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"juntossomosmas.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200004820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"justcbdmexico.com.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200004821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"justlighttechnology.justlight.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200004822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"justsayingbro.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jutfrv.tngdouq.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jutrfb.lgpkrym.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"juyfg.ykttbka.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"juyfgv.bknjubs.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"juyghv.ekofpnd.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jycvd.yuu0obb.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jycvf.qblmavm.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jyeue43rm95p.clickfunnels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jyfbv.d6gvht3.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jyfvc.ojhoior.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jyjhg.hdxacah.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jytcv.hykjrsj.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jytcv.qzgcfeb.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jytcv.zdkx30l.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jytcvf.kh2l0yu.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jytgb.nmeyijg.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jythv.dywmfry.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"jz2bab.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"k1d.vashonlove.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"k3ja6d.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kaamwalibais.co.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200004844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kafkasariotel.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kaharaerad.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kakao-daum.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kakao-daum.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kakiratc.go.ug"; content:"Host"; http_header; classtype:attempted-recon; sid:200004849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"karafuuru.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200004850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kardiologiebadkissingen.clickfunnels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kargonova.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"karllagerfeldshop.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"karllagfr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kartaltepespor.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kasba.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200004856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kashifisheries.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200004857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"katabitc.go.ug"; content:"Host"; http_header; classtype:attempted-recon; sid:200004858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"katanaroninchains.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kax02836.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kbngf.klnugee.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kbvf.ifealwz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kbvf.jmjjklf.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kcadeutagoildrilling.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kcpwr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kdlscaffolding.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200004866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"keadaancus.topijerami.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kecc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kecmanijada.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"keen-mcnulty.91-234-99-113.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200004870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"keep-passw0rd-supp0rt20211129-0106.supp0rtaaqkadq2zgnizte3ltbly2etnge5yi05ntm3lty2yjcwyzywzdjhmwa.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"keithmayberryfarms.kristenstrout.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200004872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kek-technik.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kelleyinthekitchen.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kelleysd.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kelyy22.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kemlidarti.temp.swtest.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200004877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kenpong.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kernplus.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kfcu-access.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kfcu-access.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200004881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kgbvc.yppabnr.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kgbvf.sbpkebr.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kgbvfcx.lpitlsb.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kgbvn.kxebjks.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kgcvf.xyxohfx.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kghb.qjywqib.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kghbcv.9b4dhfe.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kghbcv.ixsymzi.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kghbf.ywtmeis.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kghbv.dnyvksj.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kghbv.gezkocj.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kghbv.grkpwsc.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kghbv.rwszwdg.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kghbv.xvgfrpz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kghbv.yy4bpc9.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kghbv.z8akx01.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kghbvc.8i30zl6.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kghbvf.ihdm.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kghbvf.tezvwva.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kghcv.cviqvhr.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kghcv.fmhiexu.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kghcv.gaqrkgp.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kghcv.ioxfpwj.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kghcv.lcbsrr.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kghcv.mrcrjfd.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kghcvf.kvnruld.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kghcvx.lwjdp.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kghfd.malbovf.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kghfd.ruvxoxc.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kghvb.eylxizg.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kghvb.fezrsqg.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kghvb.jnaeqel.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kghvb.sdqcewv.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kghvb.sstkwch.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kghvbc.ojvtssx.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kghvc.mkrjrxf.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kghvc.rcxqysd.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kghvc.wgtyduq.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kghvc.xmfdzkq.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kghvcbbr.ok7nqy7.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kghvd.shushujx.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kghyb.twjccrt.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kghyu.jfadpmg.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kghyv.uczdrcd.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kghyv.vreiuzg.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kgybv.htlrkpu.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kgyub.kxwesxx.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"khalidouhdane.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"khbvf.nnnusfn.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"khgbv.eopxznw.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"khgcv.sgftqit.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"khgfgd.vlx6b5u.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"khgvc.48teh3u.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"khgvc.s8xkukz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"khjbcv.fgqrntu.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"khjbv.ukeuhnd.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"khjbvg.hsuujul.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"khjcvf.ie0vsli.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"khjgf.yjmxliy.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"khvdsc.vpfrov.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kidzeepune.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kigbvf.ufdoev.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kighb.rprhsp.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kijghy.wdgdjgmukpajpj.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kijhyu.ntjxlwl.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kijygh.iyhhlli.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kil.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200004948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kille.bw"; content:"Host"; http_header; classtype:attempted-recon; sid:200004949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kimc.ac.ke"; content:"Host"; http_header; classtype:attempted-recon; sid:200004950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kingfaisalprize.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200004951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kisiyeozelkartvizit.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kissapps.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200004953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kissmyball.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kithocivilengineering.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200004955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kiubv.cpnzsi.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kiuyn.zdlandv.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kiwutisy.cyon.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200004958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kiygv.lvuhgjc.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kiyth.nqsvfrx.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kiyubv.hsjrxca.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjbvf.crjmkxj.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjdfgh.hpcub58.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjfgcv.zhujang.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjfgh.bauozaa.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjfgh.pkmpmhl.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjfghc.soohgvv.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjfghcx.ucbikuq.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjfghv.07bxza0.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjfghv.csqvzay.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjfghv.rgnermr.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjfghv.ydkxezr.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjfghy.yrsvotn.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjfghyv.glsqdmj.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjfgv.drnnvxw.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjgccv.ftih4r2.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjghb.ecceorh.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjghb.fvmztrd.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjghb.uflvgsh.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjghb.xaml1v0.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjghb.yglqsbr.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjghb.z1rx14x.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjghbv.bzyjldb.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjghbv.eyxoxxa.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjghbv.gy77er4.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjghbv.iuacoyo.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjghbv.lexstyc.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjghbv.qlxvxaw.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjghc.4zt0nau.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjghc.xvfwcv.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjghcv.ljlsijg.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjghcv.rzwnkxn.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjghcv.untfvmv.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjghcv.yugd81q.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjghcvx.whqeuar.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjghdb.tqcqowx.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjghf.uivbrst.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjghgv.p84tuwh.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjghv.fhaimld.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200004999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjghv.y9pduqm.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjghv.ycerdtf.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjghv.zjbybxm.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjghvb.kie2i7c.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjghvc.o0izz0e.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjghvc.shengzhangjx.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjghvd.z39bo2.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjghy.udlsewx.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjghyc.jcpvlnb.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjghyv.xqnlkic.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjgybv.91w7hek.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjhbfc.vrafelz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjhbvc.fjcgtjy.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjhbvg.mcexfzo.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjhcv.hyow0ef.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjhcv.xovdpnh.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjhcvd.jxnytvl.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjhcvf.femraod.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjhcxd.hnhtuey.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjhfcx.hyptftl.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjhgcv.cpwcndy.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjhgcv.qxpswtf.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjhgv.fyemlux.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjhgv.othqrfg.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjhgvc.0mx5miy.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjhvx.igwuool.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjhygv.fvfaujh.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjhyv.ugboys.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjigh.yetcfn.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjjuhikj.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjmgh.japuoyz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjmghb.1tyfnh0.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjygh.yh0cz0.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjyghc.b8ryqx0.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjytbv.yywwzc.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kjyubv.m07vn24.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"klhjbv.sbxhayw.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"klhjbv.skpffvw.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"klhjnb.grnghqi.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kljfdtstrlnnv.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200005039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kljhbv.clpwasa.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kljhcv.jnvyaet.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kljhcv.kzmstek.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kljhvb.atdsxup.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kljhxc.bkoqwec.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kljhxc.rwmlzy.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"klockorochsmycken.se"; content:"Host"; http_header; classtype:attempted-recon; sid:200005046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"klojuh.ljqfulv.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"klujhv.keqceag.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"klujvc.vs0ixb.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kmct.edu.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200005050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kmctartskuttippuram.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kmctayurvedacollege.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kmhg.egstehq.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kmracing.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200005054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"know-paths.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kobe-denki.co.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200005056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kodencherycollege.ac.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200005057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"koerich-c-empresarial.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"koihjv.awuqsmz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"koiyub.ensvnau.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kolarexpressnews.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kone-ali123-mon-site-web-cheetah-5.cheetah.builderall.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"koteng.odoo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kpdwpl552.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kpdwpl785.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kr-bithumb.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kreaate.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"krupije.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kubfc.rwfwjo.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kubnf.rhuuzxn.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kubvc.efg9vum.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kuchkuchnights.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kucolnmyapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kudcgnho.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kughbv.iouzitr.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kughv.gglqwnk.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kughv.ruxzbqr.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kugtbv.ehskumh.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kulgn.weblium.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200005079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kumkumbhagya.su"; content:"Host"; http_header; classtype:attempted-recon; sid:200005080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kunbv.ebntrir.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kunfcxb.1py1x17.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kungdf.lbbfjlu.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kunneyscholarship.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kutgv.mdiqwta.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kuycv.lkfjekd.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kuygf.obwmsvz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kvbfg.oxvrqlz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kvlk.nl.etchfit.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kwarransragen.sragen.pramukajateng.or.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200005090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kwh3ba6dy7.9xc7zyurk2.waitforthetruck.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kybvd.i225f7e.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kyc.youthtechinc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"kyleosburn.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"l0g0n-1654546-ve.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200005095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"la-taperia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lacakery.ca"; content:"Host"; http_header; classtype:attempted-recon; sid:200005097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"laiserhillacademy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lambdapoint.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200005099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lambdaweb.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200005100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"landcredi.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"landhouseshome.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200005102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"languagede-gercustom.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200005103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"larvalab.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200005104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lasecuriterduserviceregionaleca.contactinbio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lasyaja.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200005106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"late-cloud-9e1b.payment-doc.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"late-hill-6d97.microonedrivelive.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"late-rice-0fc8.regan21.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"latinotravel.cz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lattassq.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"laubros.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"launchpad.marketmaking.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200005113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"launchpadavalaunch.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"laveryz.cloudaccess.host"; content:"Host"; http_header; classtype:attempted-recon; sid:200005115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"layanan-tarif-normal-bankbrl.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200005116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lbcpaiement-com.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200005117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"le-diablotin-rouen.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"le-site-web-de-lapostenet1.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"leadspro.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200005120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"learncricut.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"learnhtml.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200005122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lebftegfbst.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"leblancbrothers.leblancbrothers.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"leboncon-sale-transaction-2926503910.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200005125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ledatop.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"legacynutritionandtraining.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"leilaopatiodetran-sp.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lemondeceramica.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lenil.academy"; content:"Host"; http_header; classtype:attempted-recon; sid:200005130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lenkaspares.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lestarispareparts.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lets-shorten-this-url.herokuapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"leviathandesign.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200005134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lew.la"; content:"Host"; http_header; classtype:attempted-recon; sid:200005135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lfksnalsdnlasdjl.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200005136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lg-onecom-io.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lgpandassociates.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200005138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lhdjckshd.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lhjjb.asmkgmb.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lhjnb.cjhwyiw.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lhnbf.juzcxpk.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lhng.hptbpdd.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"licitacoes.olinda.pe.gov.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200005144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lienquan.garenia.vn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"life-aid.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200005146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lifesa.bwbkqud.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"liff-gateway.lineml.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200005148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"light-office.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lightboardacademy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lightboardpro.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lightboarduniversity.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lilit4prez.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"limewireelectrical.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200005154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"limit-orders-v2.onrender.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lindyandfriends.co.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200005156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"linio.applytojob.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"liniomarkets.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"link-appeal-48283.herokuapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"link-appeal-58199.herokuapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"link-appeal-58200.herokuapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"link-appeal-58201.herokuapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"link-appeal-89917.herokuapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"link-appeal-89918.herokuapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"link-appeal-89919.herokuapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"link-appeal-89920.herokuapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"link.gmreg5.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200005167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lionfish-app-edi7z.ondigitalocean.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lithiumbatteryresearch.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"little-math-4e76.m-santiago3317.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"little-wood-23ca.abssupdatedlogin.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"liturgyoutside.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200005172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"liusanchuan.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200005173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"live-drive-share.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"live-drive-share.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"live-site.hopto.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200005176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"liveconnectfix.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lively-water-08617d310.1.azurestaticapps.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200005178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lively.marbauttulo.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"livepagemybper.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ljhybv.vkpscq.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lk.pedant.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200005182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lkicvx.lyhgtue.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lkjbfg.tdzkypc.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"llilll.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lloydsbank.secure-personal-device-login.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"llwdoaxdlq.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"llyhugx.cluster028.hosting.ovh.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200005188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lnterbanlkweb.jcllq.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"loansidemed.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"local-helpdesk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"localizzan2-6.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"localso.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"locked-football-acquisitions-park.trycloudflare.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"log-defikingdams.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"log-deikifngsdoms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"log-in-banking-dkb.dyndns.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200005197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"log-widiba-eu.preview-domain.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-file-share-view-folder.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-livemcsft.ipq.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200005200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-docu-file-folder.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-drive-file-folder.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-drive-file-folder.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-drive-file-share-1.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-drive-file-share-1.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-drive-file-share-2.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-drive-file-share-2.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-drive-file-share-3.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-drive-file-share-3.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-drive-file-share-4.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-drive-file-share-4.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-drive-file-share-5.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-drive-file-share-5.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-drive-pdf-point.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-drive-pdf-point.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-file-view-folder-1.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-file-view-folder-1.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-file-view-folder-2.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-file-view-folder-2.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-file-view-folder-3.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-file-view-folder-3.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-file-view-folder-4.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-file-view-folder-4.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-file-view-folder.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-file-view-folder.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-folder-agl-coa.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-folder-agl-coa.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-id-file-storage.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-id-file-storage.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-share-file-folder.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micro-share-file-folder.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-micrsoft-onedrive-signin.sansiro324wnet.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200005232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-mtb.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-mtb.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-mtbonline.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-mtbonline.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-net-micro-inv-folder.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-net-micro-inv-folder.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-onlineconnect.laviewddns.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-services-au.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-share-file-folder-view.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-share-file-folder-view.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-share-file-folder.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-share-file-folder.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-view-share-folder-file.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login-view-share-folder-file.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login.bitkub.gq"; content:"Host"; http_header; classtype:attempted-recon; sid:200005247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login.microsoftoline.larga-me.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login.saisoncord.jp.2343432.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login.trusecureacce.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login.vpass.jp.qffddg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"login1.sitelio.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200005252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"loginmicrosoftonline-remittancedeposit.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"loginmicrosoftonlinens.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"loginmicrosoftonlineproposal.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"loginprim2.sslblindado.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"logmedo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"logn-bnncochile.cl-yg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"logn-mtb-online.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"logn-mtb-online.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"logsik.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200005261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"loibvf.iby84kn.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"loijmn.tagkmng.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lojasdstak.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200005264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lojasmagalu.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lomadesarrollos.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200005266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lomksrare.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"long-math-2485.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200005268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lookatmynewphotos.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lookinqatar.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lookserare.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"looksnrare.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"looksrare.cx"; content:"Host"; http_header; classtype:attempted-recon; sid:200005273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"looksrare.is"; content:"Host"; http_header; classtype:attempted-recon; sid:200005274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"looksrare.wf"; content:"Host"; http_header; classtype:attempted-recon; sid:200005275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"looksrrare.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200005276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"looksware.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"loopedcupes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lot-lp-x.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lovemysmile.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200005280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lp.euprefiroempreender.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lplusd.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lps.doja-marketing.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lps.kadabras-marketings.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lrs-office-tax-aids-finance-gov.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lsdaeszzxsa.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200005286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lsdxztzrx.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ltir681.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lub-supply.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lucchhi.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"luciavent.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lucy-walker.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lucyjacobs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ludo14.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"luhbv.fdfbbvz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"luxcard.luxlivingjoin.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200005296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lydab.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lyubvn.aoo0t3k.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lzpjrhe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lzuhdhkzxb.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"lzuhdhkzxb.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m.facebook.unaux.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m.fancy-bush-cf01.marhabitas.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m.help.insecurpage.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m.licenseplates.tv"; content:"Host"; http_header; classtype:attempted-recon; sid:200005305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m.mytax-iras.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200005306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m.protc.safty-pege.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m.recovery.safetyacount.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m.recovery.saftypageupdate.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m.still-band-a6a6.saftyalrt.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m.super-recipe-d45d.sombodysad.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m1tbank.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m1tbank.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m1tbnk.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m1tbnk.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m42club.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"m4ti1b.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200005317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ma-demandeameli.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maccsasred.mcaaserd.aiabsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maccsasred.mcaaserd.bdlzvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maccsasred.mcaaserd.bmozhr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maccsasred.mcaaserd.bsvdfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maccsasred.mcaaserd.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maccsasred.mcaaserd.dborfs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maccsasred.mcaaserd.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maccsasred.mcaaserd.dhvprp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maccsasred.mcaaserd.dpcijt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maccsasred.mcaaserd.dtosxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maccsasred.mcaaserd.dwvkhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maccsasred.mcaaserd.eftxrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maccsasred.mcaaserd.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maccsasred.mcaaserd.ehsiyy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maccsasred.mcaaserd.gsajzb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maccsasred.mcaaserd.hfblsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maccsasred.mcaaserd.ibyljb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maccsasred.mcaaserd.ikmkwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maccsasred.mcaaserd.jaovxc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maccsasred.mcaaserd.jaubvr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maccsasred.mcaaserd.jgahwi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maccsasred.mcaaserd.jtaykj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maccsasred.mcaaserd.lioimy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maccsasred.mcaaserd.luhbim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maccsasred.mcaaserd.lxqslk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maccsasred.mcaaserd.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maccsasred.mcaaserd.nytsha.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maccsasred.mcaaserd.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maccsasred.mcaaserd.ozicyo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maccsasred.mcaaserd.pczkai.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maccsasred.mcaaserd.pdmvfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maccsasred.mcaaserd.xlokjz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maccsasred.mcaaserd.xsedyo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maccsasred.mcaaserd.xtpqhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maccsasred.mcaaserd.yiyingzf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maccsasred.mcaaserd.ypznyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maccsasred.mcaaserd.ywmdmi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maccsasred.mcaaserd.zbomvh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maccsasred.mcaaserd.zfeixc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maccsasred.mcaaserd.zhxqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maccsasred.mcaaserd.zlrrpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"macsscsrd-asosamsnsrd.chenmanqi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"macsscsrd-asosamsnsrd.rwmcr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"macsscsrd-asosamsnsrd.wkbakq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"macsscsrd-asosamsnsrd.wozavw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"macsscsrd-asosamsnsrd.xloclk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"macsscsrd-asosamsnsrd.xvotal.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"macsscsrd-asosamsnsrd.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"macsscsrd-asosamsnsrd.zohlkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"macsscsrd-asosamsnsrd.zrzckw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"macst.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200005369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mactorecrd.co-jp-mascasord.dbsbzrx.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200005370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mactorecrd.co-jp-mascasord.gwmubqc.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200005371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mactorecrd.co-jp-mascasord.gxlxqeb.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200005372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mactorecrd.co-jp-mascasord.htiecrg.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200005373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mactorecrd.co-jp-mascasord.ujcnrwu.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200005374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mactorecrd.co-jp-mascassord.bhbwkiq.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200005375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mactorecrd.co-jp-mascassord.bjqywmu.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200005376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mactorecrd.co-jp-mascassord.gmcsfjj.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200005377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mactorecrd.co-jp-mascassord.kzjioix.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200005378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mactorecrd.co-jp-mascassord.tutxbvq.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200005379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mactravels.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200005380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"madens.com.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200005381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"madrid-web-home.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maestro.my.prod.dfg152.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200005383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maetsroard.co-jp-masscsoserd.dfowjqb.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200005384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maetsroard.co-jp-masscsoserd.noycdzz.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200005385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maetsroard.co-jp-masscsoserd.obfbhpu.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200005386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maetsroard.co-jp-masscsoserd.rzcfvqc.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200005387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maetsroard.co-jp-masscssoserd.cbdnsnj.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200005388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maetsroard.co-jp-masscssoserd.obfbhpu.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200005389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maetsroard.co-jp-masscssoserd.vzevwxj.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200005390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maetsroard.co-jp-masscssoserd.zxwzgjv.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200005391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"magaduzela.co.za"; content:"Host"; http_header; classtype:attempted-recon; sid:200005392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"magiamgiashopee.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"magicreator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"magicvelocityrating.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"magnumforces.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mahikapur.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200005397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maiduguripoloclub.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail-ovhcloud.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail-ssocloud-srvr67yhguh.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail.bungalowdubai.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail.clamps.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200005402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail.derbyde.ae"; content:"Host"; http_header; classtype:attempted-recon; sid:200005403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail.doorstepsales.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail.estartupchallenge-egabon.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail.ims-fe.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail.imsltd.london"; content:"Host"; http_header; classtype:attempted-recon; sid:200005407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail.lolwhoa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail.mksc.co.tz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail.pdc13.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail.quefix.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200005411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail.samuelscott.ca"; content:"Host"; http_header; classtype:attempted-recon; sid:200005412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail.triplespeedllc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail.uctcqf.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200005414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mail.wslconstrucoes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mailbtinternet.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200005416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mailer7.onedrive0001.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mailorange-apsuite.ukit.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200005418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mailplusrolerequestedprivatemailupdates.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200005419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mailserver7656566.blob.core.windows.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200005420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mainbscrectify.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mainnetdappbot.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200005422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maisondebaby.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"majndhuahehjwenwn10.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"majndhuahehjwenwn11.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"majndhuahehjwenwn11.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"majndhuahehjwenwn12.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"majndhuahehjwenwn2.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"majndhuahehjwenwn3.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"majndhuahehjwenwn3.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"majndhuahehjwenwn5.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"majndhuahehjwenwn6.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"majndhuahehjwenwn8.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"make-real.money"; content:"Host"; http_header; classtype:attempted-recon; sid:200005434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"makstcs-go.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200005435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"malaprontaargentina.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200005436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"malibu-waterfront.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mamavapes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mamifoundation.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200005439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mamkefu.kanuomei.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"managesaas.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mandatorydeal.co.za"; content:"Host"; http_header; classtype:attempted-recon; sid:200005442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mandhauirhabe11.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mandhauirhabe11.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mandhauirhabe3.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mandhauirhabe6.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mandhauirhabe6.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mandhauirhabe7.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mandhauirhabe8.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mandhauirhabe8.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"manledquangninh.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mannygonzales.wpcdn-a.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"manualresolve.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maplesme.cam"; content:"Host"; http_header; classtype:attempted-recon; sid:200005454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mapos.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200005455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mapsa.com.pe"; content:"Host"; http_header; classtype:attempted-recon; sid:200005456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"marcelotoledo.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200005457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"marinadayza.bustamante-avocat.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"marinatedma10.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"marinatedma14.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"marinatedma17.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"marinatedma20.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"marinatedma23.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"marinatedma26.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"marinatedma26.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200005465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"marinatedma27.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"marinatedma28.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"marinatedma29.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"marinatedma3.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"marinatedma7.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"marinoceans.cam"; content:"Host"; http_header; classtype:attempted-recon; sid:200005471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"market-mcsgo.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200005472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"marketplace-axieinfinity.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200005473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"marketplace.axieinfinity.gq"; content:"Host"; http_header; classtype:attempted-recon; sid:200005474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"marketplace.axieinflinity.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200005475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"marketplacelnfinytlaxi.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"markos.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200005477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"marlonmedia.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200005478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maryspintsizedpieces.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200005479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescooosesaserd.1238797.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescooosesaserd.2397874.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescooosesaserd.3215479.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200005482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescooosesaserd.3299978.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescooosesaserd.3978458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescooosesaserd.3978487.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescooosesaserd.3987845.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescooosesaserd.3997887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescooosesaserd.9912447.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200005488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescooosesaserd.aehkez.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescooosesaserd.bhmnyn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescooosesaserd.bmbrqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescooosesaserd.ckeqkb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescooosesaserd.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescooosesaserd.davgri.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescooosesaserd.djicub.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescooosesaserd.ehzdsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescooosesaserd.fftefq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescooosesaserd.fqaqay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescooosesaserd.fvzlph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescooosesaserd.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescooosesaserd.homhcy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescooosesaserd.hrk93.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescooosesaserd.krxyum.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescooosesaserd.mfwrsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescooosesaserd.mijkvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescooosesaserd.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescooosesaserd.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescooosesaserd.oeeppj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescooosesaserd.olbrdx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescooosesaserd.owhfzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescooosesaserd.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescooosesaserd.qmponh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescooosesaserd.raymtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescooosesaserd.rdoryw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescooosesaserd.rgwvvl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescooosesaserd.rinlvb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescooosesaserd.rtvsct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescooosesaserd.rxqkhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescooosesaserd.ssmkdz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescooosesaserd.sswfzk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescooosesaserd.subkwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescooosesaserd.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescooosesaserd.urolol.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescooosesaserd.vneggf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescooosesaserd.vzfbiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescooosesaserd.wxjoux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescooosesaserd.xfcxny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescooosesaserd.xrrtvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescoooseserd.1238797.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescoooseserd.1397848.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescoooseserd.1978777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescoooseserd.2397874.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescoooseserd.3123978.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescoooseserd.3215479.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200005534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescoooseserd.3299978.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescoooseserd.3548738.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200005536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescoooseserd.9912447.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200005537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescoooseserd.aehkez.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescoooseserd.bhmnyn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescoooseserd.bmbrqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescoooseserd.ckeqkb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescoooseserd.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescoooseserd.davgri.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescoooseserd.djicub.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescoooseserd.ehzdsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescoooseserd.fftefq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescoooseserd.fqaqay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescoooseserd.fvzlph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescoooseserd.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescoooseserd.homhcy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescoooseserd.hrk93.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescoooseserd.krxyum.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescoooseserd.mfwrsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescoooseserd.mijkvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescoooseserd.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescoooseserd.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescoooseserd.oeeppj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescoooseserd.olbrdx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescoooseserd.owhfzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescoooseserd.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescoooseserd.qmponh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescoooseserd.raymtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescoooseserd.rdoryw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescoooseserd.rgwvvl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescoooseserd.rinlvb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescoooseserd.rtvsct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescoooseserd.rxqkhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescoooseserd.ssmkdz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescoooseserd.sswfzk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescoooseserd.subkwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescoooseserd.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescoooseserd.urolol.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescoooseserd.vneggf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescoooseserd.vzfbiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescoooseserd.wxjoux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescoooseserd.xfcxny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.maseccceaoooearescoooseserd.xrrtvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseccsoerd.1238797.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseccsoerd.3123978.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseccsoerd.3197874.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseccsoerd.3587841.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseccsoerd.3978487.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseccsoerd.9912447.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200005583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseccsoerd.bhmnyn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseccsoerd.bmbrqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseccsoerd.ckeqkb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseccsoerd.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseccsoerd.djicub.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseccsoerd.fftefq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseccsoerd.fqaqay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseccsoerd.fvzlph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseccsoerd.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseccsoerd.krxyum.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseccsoerd.mijkvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseccsoerd.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseccsoerd.oeeppj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseccsoerd.olbrdx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseccsoerd.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseccsoerd.qmponh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseccsoerd.raymtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseccsoerd.rgwvvl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseccsoerd.rinlvb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseccsoerd.sswfzk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseccsoerd.urolol.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseccsoerd.vzfbiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseccsoerd.xfcxny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseccsoerd.xrrtvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseerd.1238797.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseerd.1978777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseerd.3123978.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseerd.3978487.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseerd.3987845.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseerd.3997887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseerd.aehkez.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseerd.bhmnyn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseerd.bmbrqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseerd.ckeqkb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseerd.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseerd.davgri.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseerd.djicub.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseerd.ehzdsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseerd.fftefq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseerd.fqaqay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseerd.fvzlph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseerd.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseerd.homhcy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseerd.hrk93.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseerd.krxyum.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseerd.mfwrsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseerd.mijkvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseerd.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseerd.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseerd.oeeppj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseerd.olbrdx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseerd.owhfzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseerd.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseerd.qmponh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseerd.raymtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseerd.rdoryw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseerd.rgwvvl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseerd.rinlvb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseerd.rtvsct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseerd.rxqkhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseerd.ssmkdz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseerd.sswfzk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseerd.subkwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseerd.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseerd.urolol.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseerd.vneggf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseerd.vzfbiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseerd.wxjoux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseerd.xfcxny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaaosearescoooseerd.xrrtvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescoooseccsod.2397874.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescoooseccsod.3197874.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescoooseccsod.3548738.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200005656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescoooseccsod.3978487.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescoooseccsod.3997887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescoooseccsod.9912447.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200005659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescoooseccsod.aehkez.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescoooseccsod.bhmnyn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescoooseccsod.bmbrqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescoooseccsod.ckeqkb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescoooseccsod.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescoooseccsod.davgri.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescoooseccsod.djicub.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescoooseccsod.ehzdsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescoooseccsod.fftefq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescoooseccsod.fqaqay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescoooseccsod.fvzlph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescoooseccsod.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescoooseccsod.homhcy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescoooseccsod.krxyum.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescoooseccsod.mfwrsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescoooseccsod.mijkvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescoooseccsod.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescoooseccsod.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescoooseccsod.oeeppj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescoooseccsod.olbrdx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescoooseccsod.owhfzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescoooseccsod.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescoooseccsod.qmponh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescoooseccsod.raymtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescoooseccsod.rdoryw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescoooseccsod.rgwvvl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescoooseccsod.rinlvb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescoooseccsod.rtvsct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescoooseccsod.rxqkhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescoooseccsod.ssmkdz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescoooseccsod.sswfzk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescoooseccsod.subkwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescoooseccsod.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescoooseccsod.urolol.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescoooseccsod.vneggf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescoooseccsod.vzfbiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescoooseccsod.wxjoux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescoooseccsod.xfcxny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescoooseccsod.xrrtvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescooosed.1238797.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescooosed.1978777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescooosed.3123978.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescooosed.3299978.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescooosed.3587841.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescooosed.3877845.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescooosed.3978844.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescooosed.3987845.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescooosed.3997887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescooosed.aehkez.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescooosed.bhmnyn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescooosed.bmbrqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescooosed.ckeqkb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescooosed.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescooosed.davgri.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescooosed.djicub.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescooosed.ehzdsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescooosed.fftefq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescooosed.fqaqay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescooosed.fvzlph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescooosed.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescooosed.homhcy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescooosed.krxyum.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescooosed.kthlcb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200005722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescooosed.mfwrsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescooosed.mijkvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescooosed.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescooosed.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescooosed.oeeppj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescooosed.olbrdx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescooosed.owhfzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescooosed.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescooosed.qmozk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200005731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescooosed.qmponh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescooosed.raymtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescooosed.rdoryw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescooosed.rgwvvl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescooosed.rinlvb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescooosed.rtvsct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescooosed.rxqkhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescooosed.ssmkdz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescooosed.sswfzk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescooosed.subkwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescooosed.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescooosed.urolol.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescooosed.vneggf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescooosed.vzfbiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescooosed.wxjoux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescooosed.xfcxny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceaesnccsaaserd.masecocsaeorearescooosed.xrrtvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascosesaserd.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascosesaserd.1157777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascosesaserd.2124458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascosesaserd.aulscd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascosesaserd.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascosesaserd.bjdsqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascosesaserd.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascosesaserd.ewdbda.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascosesaserd.flyveb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascosesaserd.fmttqq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascosesaserd.gwrlwh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascosesaserd.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascosesaserd.kihmid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascosesaserd.ksiudjfo.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200005762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascosesaserd.kvivli.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascosesaserd.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascosesaserd.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascosesaserd.owbxts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascosesaserd.pajngn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascosesaserd.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascosesaserd.qjgmxi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascosesaserd.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascosesaserd.rhurgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascosesaserd.sfts.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200005772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascosesaserd.tilgij.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascosesaserd.tohjkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascosesaserd.uhijmv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascosesaserd.vjkyoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascosesaserd.xjdpgi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascosesaserd.yalpuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascoseserd.1157777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascoseserd.1444588.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascoseserd.3354788.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascoseserd.a80117.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200005782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascoseserd.asxrvb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascoseserd.cemlfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascoseserd.cipgmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascoseserd.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascoseserd.ewdbda.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascoseserd.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascoseserd.hzwrnd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascoseserd.hzzpvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascoseserd.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascoseserd.jaftcq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascoseserd.jcqpfm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascoseserd.kvivli.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascoseserd.mwojiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascoseserd.nlcrmz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascoseserd.nthuga.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascoseserd.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascoseserd.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascoseserd.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascoseserd.sbelxi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascoseserd.sfts.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200005802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascoseserd.tilgij.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascoseserd.tjkoas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascoseserd.ucluzr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascoseserd.ugelbf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascoseserd.uhijmv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascoseserd.vjkyoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascoseserd.vvdmwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascoseserd.vyihmf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascoseserd.wtkiwf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascoseserd.xchztf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascoseserd.xjdpgi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascoseserd.yagtso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascoseserd.yezuns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macceooascoseserd.yxpfzh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macosasascoseccsoerd.bcjgin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macosasascoseccsoerd.bjdsqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macosasascoseccsoerd.cartil.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macosasascoseccsoerd.dsyqit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macosasascoseccsoerd.fmttqq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macosasascoseccsoerd.gvtkxq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macosasascoseccsoerd.jcqpfm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macosasascoseccsoerd.jtpyia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macosasascoseccsoerd.kobagq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macosasascoseccsoerd.mwojiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macosasascoseccsoerd.nthuga.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macosasascoseccsoerd.qjgmxi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macosasascoseccsoerd.tilgij.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macosasascoseccsoerd.tjkoas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macosasascoseccsoerd.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macosasascoseccsoerd.ucluzr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macosasascoseccsoerd.uhijmv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macosasascoseccsoerd.uobmas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macosasascoseccsoerd.vfelco.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macosasascoseccsoerd.vjkyoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macosasascoseccsoerd.xchztf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macosasascoseccsoerd.xjdpgi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macosasascoseccsoerd.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macosasascoseccsoerd.yezuns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macosasascoseccsoerd.yxpfzh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macosasascoseerd.1444588.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macosasascoseerd.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macosasascoseerd.coinwallet.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macosasascoseerd.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macosasascoseerd.drqelj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macosasascoseerd.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macosasascoseerd.gwrrdx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macosasascoseerd.hzwrnd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macosasascoseerd.kobagq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macosasascoseerd.kvivli.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macosasascoseerd.kzstoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macosasascoseerd.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macosasascoseerd.qjgmxi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macosasascoseerd.sdutxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macosasascoseerd.sfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200005856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macosasascoseerd.ssminn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macosasascoseerd.uobmas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macosasascoseerd.vfelco.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macosasascoseerd.vgedvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macosasascoseerd.xjdpgi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macosasascoseerd.xmlqpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macosasascoseerd.zhhqjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macoserascoseccsod.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macoserascoseccsod.bcjgin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macoserascoseccsod.cartil.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macoserascoseccsod.dsyqit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macoserascoseccsod.ewdbda.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macoserascoseccsod.hzwrnd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macoserascoseccsod.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macoserascoseccsod.kobagq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macoserascoseccsod.ksiudjfo.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200005872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macoserascoseccsod.kvivli.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macoserascoseccsod.ojfyvi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macoserascoseccsod.owbxts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macoserascoseccsod.qjgmxi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macoserascoseccsod.sbelxi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macoserascoseccsod.ssminn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macoserascoseccsod.tohjkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macoserascoseccsod.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macoserascoseccsod.ugelbf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macoserascoseccsod.umjnpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macoserascoseccsod.xeoadw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macoserascoseccsod.yagtso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macoserascoseccsod.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macoserascosed.a80117.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200005886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macoserascosed.asxrvb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macoserascosed.bcjgin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macoserascosed.chaincomp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macoserascosed.dsyqit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macoserascosed.ewdbda.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macoserascosed.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macoserascosed.fmttqq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macoserascosed.fuufvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macoserascosed.jtpyia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macoserascosed.kihmid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macoserascosed.kobagq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macoserascosed.kzstoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macoserascosed.mrogod.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macoserascosed.mwojiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macoserascosed.nthuga.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macoserascosed.owbxts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macoserascosed.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macoserascosed.sfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200005904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macoserascosed.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macoserascosed.uobmas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macoserascosed.vfelco.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macoserascosed.vjzvtr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macoserascosed.xchztf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macoserascosed.xjdpgi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macoserascosed.yagtso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macoserascosed.yezuns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macoserascosed.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macoserascosed.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanccaserd.macoserascosed.zhhqjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceoosaserd.0633348.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceoosaserd.1223478.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceoosaserd.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceoosaserd.15537777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceoosaserd.2354387.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceoosaserd.2355587.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceoosaserd.3333347.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceoosaserd.3456588.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceoosaserd.3533357.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceoosaserd.3545331.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceoosaserd.3556678.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceoosaserd.3888347.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceoosaserd.4478687.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceoosaserd.4488877.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceoosaserd.4566368.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceoosaserd.4566878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceoosaserd.4678865.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceoosaserd.4687999.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceoosaserd.5378887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceoosaserd.5387814.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceoosaserd.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceoosaserd.6123878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceoosaserd.6366778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceoosaserd.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceoosaserd.6788777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceoosaserd.6788877.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceoosaserd.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceoosaserd.6887453.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceoosaserd.6975877.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceoosaserd.6979885.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceoosaserd.7688477.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceoosaserd.7788513.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceoosaserd.9556788.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceoosaserd.9978777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceoosaserd.9997854.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceoosaserd.9997875.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceoosaserd.ahiatgp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceoosaserd.ahibtgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceoosaserd.ahictgl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceoosaserd.ahidtgf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceoosaserd.ahigtgg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceoosaserd.ahihtgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceoosaserd.avmueo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceoosaserd.biyzde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.0633348.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.1223478.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.15537777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.2354387.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.2355587.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.3333347.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.3456588.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.3533357.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.3545331.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.3556678.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.3888347.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.4478687.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.4488877.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.4566368.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.4566878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.4678865.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.4687999.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.5378887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.5387814.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.6123878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.6366778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.6788777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.6788877.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.6887453.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.6975877.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.6979885.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.7688477.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.7788513.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.9556788.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.9978777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.9997854.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.9997875.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200005995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.ahiatgp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.ahibtgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.ahictgl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.ahidtgf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200005999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.ahigtgg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.ahihtgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.avmueo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.baskb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.biyzde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.bozoob.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.fmrxl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.gpsjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.hdjtd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.ipnnct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.iwggbt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.izokl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.jayocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.jqwgwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.kbjbz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.lheqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.mengdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.mhftfp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.npibd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.ohvcp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.ojpih.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.pfbueg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.plcxj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.qglno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.qqwhps.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.rbfmfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.sdaere.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.sfts.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200006032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.sfts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.uynfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.velxb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.vnbxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.vppvl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.xopup.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.ylbde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.ymgar.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macceooserd.ypzcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosasccsoerd.rbfmfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.0633348.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.1223478.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.15537777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.2354387.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.2355587.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.3333347.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.3456588.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.3533357.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.3545331.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.3556678.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.3888347.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.4478687.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.4488877.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.4566368.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.4566878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.4678865.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.4687999.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.5378887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.5387814.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.6123878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.6366778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.6788777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.6788877.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.6887453.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.6975877.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.6979885.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.7688477.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.7788513.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.9556788.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.9978777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.9997854.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.9997875.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.ahiatgp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.ahibtgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.ahictgl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.ahidtgf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.ahigtgg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.ahihtgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.avmueo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.baskb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.biyzde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.bozoob.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.fmrxl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.gpsjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.hdjtd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.ipnnct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.iwggbt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.izokl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.jayocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.jqwgwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.kbjbz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.mhftfp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.npibd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.ohvcp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.ojpih.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.pfbueg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.plcxj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.qglno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.qqwhps.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.rbfmfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.sdaere.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.sfts.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200006114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.sfts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.uynfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.velxb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.vnbxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.vppvl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.xopup.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.ylbde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.ymgar.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macosaserd.ypzcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.0633348.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.1223478.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.15537777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.2354387.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.2355587.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.3333347.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.3456588.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.3533357.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.3545331.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.3556678.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.3888347.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.4478687.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.4488877.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.4566368.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.4566878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.4678865.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.4687999.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.5378887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.5387814.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.6123878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.6366778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.6788777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.6788877.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.6887453.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.6975877.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.6979885.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.7688477.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.7788513.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.9556788.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.9978777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.9997854.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.9997875.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.ahiatgp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.ahibtgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.ahictgl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.ahidtgf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.ahigtgg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.ahihtgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.avmueo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.biyzde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.bozoob.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.gpsjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.hdjtd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.ipnnct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.iwggbt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.izokl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.jayocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.jqwgwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.kbjbz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.lheqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.lokasid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.lsksodi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.lslxisoa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.mhftfp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.npanni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.npibd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.ohvcp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.ojpih.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.pfbueg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.plcxj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.qglno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.qqwhps.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.rbfmfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.sfts.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200006197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.sfts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.uynfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.velxb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.vnbxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.vppvl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.xopup.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.ylbde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.ymgar.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masceanrd.macoserd.ypzcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecccaooarsoasoceosesaserd.1366778.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecccaooarsoasoceosesaserd.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecccaooarsoasoceosesaserd.3968745.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecccaooarsoasoceosesaserd.4358879.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecccaooarsoasoceosesaserd.5633845.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecccaooarsoasoceosesaserd.6945785.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecccaooarsoasoceosesaserd.7786945.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecccaooarsoasoceosesaserd.7997845.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecccaooarsoasoceosesaserd.8676455.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecccaooarsoasoceosesaserd.9784585.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecccaooarsoasoceosesaserd.adijps.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecccaooarsoasoceosesaserd.ankdujfkx.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200006219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecccaooarsoasoceosesaserd.blyqdj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecccaooarsoasoceosesaserd.hgzklt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecccaooarsoasoceosesaserd.nnawja.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecccaooarsoasoceosesaserd.nzvzoq.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200006223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecccaooarsoasoceosesaserd.otfake.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecccaooarsoasoceosesaserd.wjgomb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecccaooarsoasoceosesaserd.xfpmrv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecccaooarsoasoceosesaserd.xybwxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecccaooarsoasoceosesaserd.xzeejb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecccaooarsoasoceosesaserd.ykbzoq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecccaooarsoasoceosesaserd.ynytah.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecccaooarsoasoceosesaserd.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecccaooarsoasoceosesaserd.yqpqaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecccaooarsoasoceosesaserd.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecccaooarsoasoceoseserd.239978.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecccaooarsoasoceoseserd.3968745.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecccaooarsoasoceoseserd.4358879.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecccaooarsoasoceoseserd.5468785.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecccaooarsoasoceoseserd.6378791.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecccaooarsoasoceoseserd.7786945.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecccaooarsoasoceoseserd.9784585.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecccaooarsoasoceoseserd.blyqdj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecccaooarsoasoceoseserd.ijhojg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecccaooarsoasoceoseserd.ilblz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecccaooarsoasoceoseserd.loqjz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecccaooarsoasoceoseserd.otfake.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecccaooarsoasoceoseserd.rfygke.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecccaooarsoasoceoseserd.wjgomb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecccaooarsoasoceoseserd.xfpmrv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecccaooarsoasoceoseserd.xybwxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecccaooarsoasoceoseserd.ykbzoq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecccaooarsoasoceoseserd.ynytah.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecccaooarsoasoceoseserd.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecccaooarsoasoceoseserd.yqpqaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecccaooarsoasoceoseserd.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaorarsoasoceoseccsod.1239978.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaorarsoasoceoseccsod.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaorarsoasoceoseccsod.3968745.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaorarsoasoceoseccsod.4687957.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaorarsoasoceoseccsod.6378791.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaorarsoasoceoseccsod.6978458.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaorarsoasoceoseccsod.9784585.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaorarsoasoceoseccsod.ankdujfkx.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200006262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaorarsoasoceoseccsod.auxfvv.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200006263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaorarsoasoceoseccsod.blyqdj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaorarsoasoceoseccsod.fzcvxp.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200006265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaorarsoasoceoseccsod.hdivud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaorarsoasoceoseccsod.ijhojg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaorarsoasoceoseccsod.ilqmcz.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200006268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaorarsoasoceoseccsod.janbl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaorarsoasoceoseccsod.neqnpg.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200006270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaorarsoasoceoseccsod.nnawja.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaorarsoasoceoseccsod.wjgomb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaorarsoasoceoseccsod.xfpmrv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaorarsoasoceoseccsod.xybwxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaorarsoasoceoseccsod.xzeejb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaorarsoasoceoseccsod.yangyang44.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200006276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaorarsoasoceoseccsod.ykbzoq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaorarsoasoceoseccsod.ynytah.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaorarsoasoceoseccsod.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaorarsoasoceoseccsod.yqpqaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaorarsoasoceoseccsod.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaorarsoasoceosed.1239978.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaorarsoasoceosed.1366778.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaorarsoasoceosed.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaorarsoasoceosed.7786945.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaorarsoasoceosed.8676455.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaorarsoasoceosed.93544117.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaorarsoasoceosed.9978754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaorarsoasoceosed.blyqdj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaorarsoasoceosed.duikdo.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200006290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaorarsoasoceosed.eaosey.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaorarsoasoceosed.janbl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaorarsoasoceosed.neqnpg.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200006293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaorarsoasoceosed.njlrxn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaorarsoasoceosed.nzvzoq.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200006295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaorarsoasoceosed.rfygke.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaorarsoasoceosed.wjgomb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaorarsoasoceosed.wogwe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaorarsoasoceosed.xfpmrv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaorarsoasoceosed.xrwetd.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200006300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaorarsoasoceosed.xybwxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaorarsoasoceosed.ykbzoq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaorarsoasoceosed.ynytah.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaorarsoasoceosed.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaorarsoasoceosed.yqpqaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaorarsoasoceosed.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseccsoerd.1239978.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseccsoerd.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseccsoerd.3968745.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseccsoerd.4358879.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseccsoerd.5633845.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseccsoerd.6378791.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseccsoerd.6978458.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseccsoerd.9784585.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseccsoerd.adijps.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseccsoerd.ankdujfkx.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200006316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseccsoerd.aymaus.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200006317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseccsoerd.fzcvxp.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200006318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseccsoerd.hdivud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseccsoerd.ilqmcz.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200006320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseccsoerd.nedpvy.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200006321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseccsoerd.njlrxn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseccsoerd.nzvzoq.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200006323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseccsoerd.otfake.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseccsoerd.wjgomb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseccsoerd.xfpmrv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseccsoerd.xybwxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseccsoerd.yangyang44.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200006328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseccsoerd.ykbzoq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseccsoerd.ynytah.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseccsoerd.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseccsoerd.yqpqaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseccsoerd.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseerd.1239978.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseerd.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseerd.366778.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseerd.4358879.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseerd.4687957.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseerd.5468785.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseerd.5633845.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseerd.6378791.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseerd.6945785.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseerd.7786945.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseerd.7997845.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseerd.8676455.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseerd.9978754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseerd.adijps.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseerd.aljreh.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200006348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseerd.ankdujfkx.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200006349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseerd.auxfvv.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200006350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseerd.eaosey.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseerd.fzcvxp.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200006352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseerd.ijhojg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseerd.janbl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseerd.wjgomb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseerd.xfpmrv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseerd.xybwxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseerd.ykbzoq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseerd.ynytah.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseerd.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseerd.yqpqaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseerd.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecccaooarsoasocosesaserd.1239978.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecccaooarsoasocosesaserd.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecccaooarsoasocosesaserd.3968745.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecccaooarsoasocosesaserd.4687957.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecccaooarsoasocosesaserd.6945785.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecccaooarsoasocosesaserd.6978458.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecccaooarsoasocosesaserd.9784585.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecccaooarsoasocosesaserd.ilblz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecccaooarsoasocosesaserd.loqjz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecccaooarsoasocosesaserd.njlrxn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecccaooarsoasocosesaserd.nnawja.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecccaooarsoasocosesaserd.nzvzoq.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200006374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecccaooarsoasocosesaserd.otfake.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecccaooarsoasocosesaserd.shzrab.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200006376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecccaooarsoasocosesaserd.wjgomb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecccaooarsoasocosesaserd.xfpmrv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecccaooarsoasocosesaserd.xybwxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecccaooarsoasocosesaserd.xzeejb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecccaooarsoasocosesaserd.yangyang44.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200006381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecccaooarsoasocosesaserd.ykbzoq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecccaooarsoasocosesaserd.ynytah.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecccaooarsoasocosesaserd.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecccaooarsoasocosesaserd.yqpqaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecccaooarsoasocosesaserd.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecccaooarsoasocoseserd.1239978.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecccaooarsoasocoseserd.239978.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecccaooarsoasocoseserd.366778.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecccaooarsoasocoseserd.7786945.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecccaooarsoasocoseserd.93544117.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecccaooarsoasocoseserd.9978754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecccaooarsoasocoseserd.aymaus.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200006393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecccaooarsoasocoseserd.rfygke.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecccaooarsoasocoseserd.shzrab.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200006395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecccaooarsoasocoseserd.wjgomb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecccaooarsoasocoseserd.xfpmrv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecccaooarsoasocoseserd.xybwxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecccaooarsoasocoseserd.yangyang44.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200006399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecccaooarsoasocoseserd.ykbzoq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecccaooarsoasocoseserd.ynytah.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecccaooarsoasocoseserd.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecccaooarsoasocoseserd.yqpqaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecccaooarsoasocoseserd.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaorarsoasocoseccsod.1239978.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaorarsoasocoseccsod.239978.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaorarsoasocoseccsod.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaorarsoasocoseccsod.366778.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaorarsoasocoseccsod.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaorarsoasocoseccsod.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaorarsoasocoseccsod.5633845.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaorarsoasocoseccsod.6378791.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaorarsoasocoseccsod.9784585.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaorarsoasocoseccsod.auxfvv.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200006414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaorarsoasocoseccsod.hdjyfur.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200006415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaorarsoasocoseccsod.ijhojg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaorarsoasocoseccsod.ilblz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaorarsoasocoseccsod.janbl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaorarsoasocoseccsod.nedpvy.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200006419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaorarsoasocoseccsod.rfygke.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaorarsoasocoseccsod.vkzpru.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200006421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaorarsoasocoseccsod.wjgomb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaorarsoasocoseccsod.xfpmrv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaorarsoasocoseccsod.xybwxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaorarsoasocoseccsod.xzeejb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaorarsoasocoseccsod.ykbzoq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaorarsoasocoseccsod.ynytah.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaorarsoasocoseccsod.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaorarsoasocoseccsod.yqpqaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaorarsoasocoseccsod.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaorarsoasocosed.1239978.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaorarsoasocosed.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaorarsoasocosed.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaorarsoasocosed.8676455.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaorarsoasocosed.93544117.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaorarsoasocosed.9784585.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaorarsoasocosed.9978754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaorarsoasocosed.ankdujfkx.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200006438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaorarsoasocosed.hgzklt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaorarsoasocosed.ilblz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaorarsoasocosed.loqjz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaorarsoasocosed.njlrxn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaorarsoasocosed.nzvzoq.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200006443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaorarsoasocosed.wjgomb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaorarsoasocosed.wogwe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaorarsoasocosed.xfpmrv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaorarsoasocosed.xybwxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaorarsoasocosed.xzeejb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaorarsoasocosed.ykbzoq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaorarsoasocosed.ynytah.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaorarsoasocosed.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaorarsoasocosed.yqpqaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaorarsoasocosed.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseccsoerd.12380978.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseccsoerd.366778.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseccsoerd.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseccsoerd.3968745.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseccsoerd.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseccsoerd.4358879.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseccsoerd.4687957.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseccsoerd.5468785.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseccsoerd.5633845.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseccsoerd.7786945.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseccsoerd.9978754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseccsoerd.ankdujfkx.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200006465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseccsoerd.auxfvv.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200006466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseccsoerd.blyqdj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseccsoerd.duikdo.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200006468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseccsoerd.fzcvxp.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200006469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseccsoerd.hdivud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseccsoerd.hgzklt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseccsoerd.ilblz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseccsoerd.loqjz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseccsoerd.neqnpg.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200006474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseccsoerd.rfygke.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseccsoerd.vkzpru.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200006476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseccsoerd.wjgomb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseccsoerd.xfpmrv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseccsoerd.xybwxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseccsoerd.ykbzoq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseccsoerd.ynytah.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseccsoerd.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseccsoerd.yqpqaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseccsoerd.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseerd.1239978.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseerd.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseerd.3968745.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseerd.4687957.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseerd.5468785.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseerd.5633845.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseerd.6978458.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseerd.8676455.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseerd.9784585.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseerd.9978754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseerd.adijps.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseerd.aljreh.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200006496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseerd.aymaus.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200006497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseerd.duikdo.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200006498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseerd.hdivud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseerd.hgzklt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseerd.ijhojg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseerd.janbl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseerd.neqnpg.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200006503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseerd.njlrxn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseerd.nnawja.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseerd.srrnqt.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200006506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseerd.wjgomb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseerd.xfpmrv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseerd.xrwetd.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200006509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseerd.xybwxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseerd.yangyang44.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200006511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseerd.ykbzoq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseerd.ynytah.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseerd.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseerd.yqpqaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascecaesncsaaserd.masecocaosarsoasocoseerd.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesceard.mcasord.aformd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesceard.mcasord.aiabsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesceard.mcasord.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesceard.mcasord.avqtnx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesceard.mcasord.bmozhr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesceard.mcasord.chgskm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesceard.mcasord.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesceard.mcasord.dfhxow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesceard.mcasord.dhvprp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesceard.mcasord.dlsefg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesceard.mcasord.dtosxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesceard.mcasord.dxjcrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesceard.mcasord.ehbrwp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesceard.mcasord.ehsiyy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesceard.mcasord.eonors.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesceard.mcasord.espkgb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesceard.mcasord.fgopqn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesceard.mcasord.fodxlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesceard.mcasord.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesceard.mcasord.iahbzj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesceard.mcasord.jaubvr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesceard.mcasord.jcxaec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesceard.mcasord.jgaooc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesceard.mcasord.jjtgpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesceard.mcasord.jpjxxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesceard.mcasord.kzadys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesceard.mcasord.lnkmoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesceard.mcasord.lvswrz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesceard.mcasord.manljw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesceard.mcasord.mltuey.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesceard.mcasord.okpufh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesceard.mcasord.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesceard.mcasord.ozicyo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesceard.mcasord.powszm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesceard.mcasord.pwzivx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesceard.mcasord.qnsjhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesceard.mcasord.rbtuib.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesceard.mcasord.wpoawh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesceard.mcasord.xjkfdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesceard.mcasord.xlftxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesceard.mcasord.xvebfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesceard.mcasord.yaaabg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesceard.mcasord.yltsps.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesceard.mcasord.ypznyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesceard.mcasord.ywmdmi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesceard.mcasord.zbqfwh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesceard.mcasord.zwldnt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesscssserd.aaosaeasmansnerd.rhxhhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesscssserd.aaosaeasmansnerd.sscssr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesscssserd.aaosaeasmansnerd.tciheh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesscssserd.aaosaeasmansnerd.uasxxj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesscssserd.aaosaeasmansnerd.webyzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesssserd.aaosmsaansnerd.trxpth.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesssserd.aaosmsaansnerd.tzmndc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascesssserd.aaosmsaansnerd.wdzxnt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascioosoerd.masicesccrerd.rnsjyy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascscssserd.aaoeasmansnerd.rezkdk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascscssserd.aaoeasmansnerd.txvcqg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascseoaoserd.maacsreoed.aebyti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascseoaoserd.maacsreoed.ahatzx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascseoaoserd.maacsreoed.aiabsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascseoaoserd.maacsreoed.bdlzvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascseoaoserd.maacsreoed.cormdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascseoaoserd.maacsreoed.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascseoaoserd.maacsreoed.dpcijt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascseoaoserd.maacsreoed.dxjcrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascseoaoserd.maacsreoed.eftxrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascseoaoserd.maacsreoed.egniix.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascseoaoserd.maacsreoed.ehbrwp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascseoaoserd.maacsreoed.ehsiyy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascseoaoserd.maacsreoed.ejxxpq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascseoaoserd.maacsreoed.eonors.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascseoaoserd.maacsreoed.gqnrcz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascseoaoserd.maacsreoed.gsajzb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascseoaoserd.maacsreoed.hiqgjp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascseoaoserd.maacsreoed.hlnifq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascseoaoserd.maacsreoed.hrzgox.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascseoaoserd.maacsreoed.hupxqb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascseoaoserd.maacsreoed.hxsyjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascseoaoserd.maacsreoed.jaubvr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascseoaoserd.maacsreoed.jgahwi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascseoaoserd.maacsreoed.jgaooc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascseoaoserd.maacsreoed.joriqb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascseoaoserd.maacsreoed.juocax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascseoaoserd.maacsreoed.lxqslk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascseoaoserd.maacsreoed.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascseoaoserd.maacsreoed.pczkai.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascseoaoserd.maacsreoed.pwzivx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascseoaoserd.maacsreoed.qnsjhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascseoaoserd.maacsreoed.rabbhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascseoaoserd.maacsreoed.wwbmod.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascseoaoserd.maacsreoed.xlokjz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascseoaoserd.maacsreoed.xnskxw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascseoaoserd.maacsreoed.xtpqhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascseoaoserd.maacsreoed.ywmdmi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascseoaoserd.maacsreoed.zbqfwh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascseoaoserd.maacsreoed.zfeixc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascseoaoserd.maacsreoed.zhxqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascsoesosrdo.macsaord.axltlg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascsoesosrdo.macsaord.axxgwf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascsoesosrdo.macsaord.fjxrzl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascsoesssorod.cmacsaord.dzzeqx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascsoesssorod.cmacsaord.fpmrgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascsoesssorod.cmacsaord.hlztae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascsoesssorod.cmacsaord.hnekal.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascsosord.macsaord.dooqny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascsosord.macsaord.hjvbkp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascsosord.macsaord.hndvyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascsosord.macsaord.jdszhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascsosord.macsaord.khvkor.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascsossord.cmacsaord.axxgwf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascsossord.cmacsaord.cguojj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascsossord.cmacsaord.flvxkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascsossord.cmacsaord.ilbsch.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascssserd.aaosmansnerd.rezkdk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascssserd.aaosmansnerd.sscssr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascssserd.aaosmansnerd.tqsnfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mascssserd.aaosmansnerd.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mashraqisteel.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200006635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorecsrd.masorceasrd.cunrtzq.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200006636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorecsrd.masorceasrd.nxdpqql.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200006637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorecsrd.masorceasrd.wnvdsot.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200006638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorecsrd.masoreasrd.fezipzi.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200006639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorecsrd.masoreasrd.mjtgocv.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200006640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorecsrd.masoreasrd.pljlwoa.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200006641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorecsrd.masoreasrd.pzeokqp.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200006642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorecsrd.masoreasrd.tapuuxd.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200006643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorecsrd.masoreasrd.zuenrzs.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200006644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoceasrd.1235439.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoceasrd.1354387.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoceasrd.2558878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoceasrd.3838833.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoceasrd.4535888.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoceasrd.6687784.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoceasrd.6786787.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoceasrd.6997854.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoceasrd.6997887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoceasrd.9697555.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoceasrd.aiex.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoceasrd.axs.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200006656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoceasrd.bchain.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200006657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoceasrd.bitpay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoceasrd.cehua.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200006659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoceasrd.coinbig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoceasrd.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoceasrd.dingzhi.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200006662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoceasrd.diot.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoceasrd.eefi.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200006664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoceasrd.jiami.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200006665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoceasrd.jshdiwje.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoceasrd.junhan.wang"; content:"Host"; http_header; classtype:attempted-recon; sid:200006667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoceasrd.koplsib.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoceasrd.nftcn.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoceasrd.pinggu.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200006670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoceasrd.platon.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200006671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoceasrd.rolling41.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoceasrd.sbfaka.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoceasrd.shangpin.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200006674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoceasrd.suifeng.asia"; content:"Host"; http_header; classtype:attempted-recon; sid:200006675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoceasrd.wangcaitongbao6.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoceasrd.wechain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoceasrd.wiot.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoceasrd.xiaomi8.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200006679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoceasrd.yanjishoukuai10.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200006680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoceasrd.yingjikuaijie1.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoceasrd.yingjikuaijie2.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoceasrd.yingjikuaijie3.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoceasrd.yingjikuaijie4.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoceasrd.yingjiyoupin6.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoceasrd.yingjiyoupin8.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoceasrd.yxfspd.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoeasrd.1235439.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoeasrd.1354387.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoeasrd.2558878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoeasrd.3838833.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoeasrd.4535888.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoeasrd.6687784.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoeasrd.6786787.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoeasrd.6997854.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoeasrd.6997887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoeasrd.9697555.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoeasrd.aiex.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoeasrd.axs.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200006699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoeasrd.bchain.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200006700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoeasrd.bitpay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoeasrd.cehua.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200006702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoeasrd.coinbig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoeasrd.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoeasrd.dingzhi.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200006705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoeasrd.diot.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoeasrd.eefi.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200006707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoeasrd.jiami.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200006708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoeasrd.jshdiwje.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoeasrd.junhan.wang"; content:"Host"; http_header; classtype:attempted-recon; sid:200006710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoeasrd.koplsia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoeasrd.koplsib.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoeasrd.nftcn.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoeasrd.particularly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoeasrd.pinggu.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200006715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoeasrd.platon.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200006716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoeasrd.rolling41.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoeasrd.sbfaka.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoeasrd.shangpin.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200006719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoeasrd.suifeng.asia"; content:"Host"; http_header; classtype:attempted-recon; sid:200006720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoeasrd.wangcaitongbao6.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoeasrd.wangcaitongbao7.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoeasrd.wechain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoeasrd.wiot.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoeasrd.yingjikuaijie1.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoeasrd.yingjikuaijie2.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoeasrd.yingjikuaijie3.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoeasrd.yingjikuaijie4.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoeasrd.yingjiyoupin6.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoeasrd.yingjiyoupin8.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresecsrd.masorcoeasrd.yxfspd.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecocsrd.1235439.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecocsrd.1354387.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecocsrd.2558878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecocsrd.3838833.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecocsrd.4535888.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecocsrd.6687784.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecocsrd.6786787.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecocsrd.6997854.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecocsrd.6997887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecocsrd.9697555.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecocsrd.aiex.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecocsrd.axs.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200006743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecocsrd.bchain.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200006744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecocsrd.bitpay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecocsrd.cehua.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200006746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecocsrd.coconaicha.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecocsrd.coinbig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecocsrd.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecocsrd.dingzhi.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200006750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecocsrd.eefi.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200006751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecocsrd.jiami.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200006752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecocsrd.jshdiwje.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecocsrd.junhan.wang"; content:"Host"; http_header; classtype:attempted-recon; sid:200006754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecocsrd.koplsib.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecocsrd.nftcn.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecocsrd.pinggu.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200006757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecocsrd.platon.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200006758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecocsrd.rolling41.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecocsrd.sbfaka.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecocsrd.shangpin.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200006761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecocsrd.suifeng.asia"; content:"Host"; http_header; classtype:attempted-recon; sid:200006762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecocsrd.uvwxyz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecocsrd.wangcaitongbao6.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecocsrd.wangcaitongbao7.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecocsrd.wechain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecocsrd.wiot.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecocsrd.yingjikuaijie1.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecocsrd.yingjikuaijie2.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecocsrd.yingjikuaijie3.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecocsrd.yingjikuaijie4.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecocsrd.yingjiyoupin6.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecocsrd.yingjiyoupin8.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecocsrd.yxfspd.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecosrd.1235439.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecosrd.1354387.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecosrd.2558878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecosrd.3838833.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecosrd.4535888.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecosrd.6687784.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecosrd.6786787.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecosrd.6997854.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecosrd.6997887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecosrd.9697555.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecosrd.aiex.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecosrd.axs.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200006786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecosrd.bchain.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200006787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecosrd.bitpay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecosrd.cehua.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200006789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecosrd.coinbig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecosrd.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecosrd.dingzhi.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200006792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecosrd.diot.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecosrd.djkskoc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecosrd.eefi.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200006795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecosrd.jiami.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200006796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecosrd.junhan.wang"; content:"Host"; http_header; classtype:attempted-recon; sid:200006797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecosrd.koplsib.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecosrd.nftcn.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecosrd.pinggu.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200006800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecosrd.platon.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200006801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecosrd.rolling41.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecosrd.sbfaka.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecosrd.shangpin.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200006804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecosrd.suifeng.asia"; content:"Host"; http_header; classtype:attempted-recon; sid:200006805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecosrd.uvwxyz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecosrd.wangcaitongbao6.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecosrd.wangcaitongbao7.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecosrd.wechain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecosrd.wiot.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecosrd.xiaomi8.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200006811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecosrd.yanjishoukuai10.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200006812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecosrd.yingjikuaijie1.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecosrd.yingjikuaijie2.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecosrd.yingjikuaijie3.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecosrd.yingjikuaijie4.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecosrd.yingjiyoupin6.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecosrd.yingjiyoupin8.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresesrd.masorecosrd.yxfspd.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresrd.masorecsrd.nlmykbl.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200006820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresrd.masorecsrd.omgsrcq.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200006821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresrd.masorecsrd.pchfbwd.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200006822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresrd.masorecsrd.qhjwkyv.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200006823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresrd.masorecsrd.ryuesms.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200006824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresrd.masorecsrd.vobitpc.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200006825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresrd.masorecsrd.xonhdyj.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200006826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresrd.masorecsrd.zrqkwlu.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200006827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresrd.masoresrd.apauokq.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200006828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresrd.masoresrd.fezipzi.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200006829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresrd.masoresrd.nxdpqql.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200006830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masoresrd.masoresrd.ycgsvki.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200006831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorcceasrd.1235439.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorcceasrd.1354387.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorcceasrd.2558878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorcceasrd.3838833.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorcceasrd.4535888.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorcceasrd.6687784.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorcceasrd.6786787.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorcceasrd.6997854.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorcceasrd.6997887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorcceasrd.9697555.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorcceasrd.aiex.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorcceasrd.axs.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200006843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorcceasrd.bchain.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200006844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorcceasrd.bitpay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorcceasrd.cehua.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200006846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorcceasrd.coconaicha.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorcceasrd.coinbig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorcceasrd.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorcceasrd.dingzhi.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200006850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorcceasrd.diot.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorcceasrd.eefi.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200006852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorcceasrd.jiami.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200006853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorcceasrd.junhan.wang"; content:"Host"; http_header; classtype:attempted-recon; sid:200006854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorcceasrd.koplsia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorcceasrd.nftcn.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorcceasrd.pinggu.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200006857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorcceasrd.platon.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200006858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorcceasrd.rolling41.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorcceasrd.sbfaka.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorcceasrd.shangpin.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200006861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorcceasrd.suifeng.asia"; content:"Host"; http_header; classtype:attempted-recon; sid:200006862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorcceasrd.uvwxyz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorcceasrd.wangcaitongbao6.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorcceasrd.wangcaitongbao7.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorcceasrd.wechain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorcceasrd.wiot.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorcceasrd.xiaomi8.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200006868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorcceasrd.yingjikuaijie1.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorcceasrd.yingjikuaijie2.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorcceasrd.yingjikuaijie3.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorcceasrd.yingjikuaijie4.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorcceasrd.yingjiyoupin6.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorcceasrd.yingjiyoupin8.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorcceasrd.yxfspd.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorceasrd.1235439.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorceasrd.1354387.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorceasrd.2558878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorceasrd.3838833.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorceasrd.4535888.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorceasrd.6687784.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorceasrd.6786787.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorceasrd.6997854.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorceasrd.6997887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorceasrd.9697555.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorceasrd.aiex.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorceasrd.axs.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200006887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorceasrd.bchain.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200006888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorceasrd.bitpay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorceasrd.cehua.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200006890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorceasrd.coinbig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorceasrd.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorceasrd.dingzhi.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200006893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorceasrd.diot.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorceasrd.djkskoc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorceasrd.eefi.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200006896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorceasrd.jiami.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200006897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorceasrd.junhan.wang"; content:"Host"; http_header; classtype:attempted-recon; sid:200006898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorceasrd.koplsia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorceasrd.nftcn.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorceasrd.pinggu.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200006901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorceasrd.platon.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200006902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorceasrd.rolling41.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorceasrd.sbfaka.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorceasrd.shangpin.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200006905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorceasrd.suifeng.asia"; content:"Host"; http_header; classtype:attempted-recon; sid:200006906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorceasrd.uvwxyz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorceasrd.wangcaitongbao6.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorceasrd.wangcaitongbao7.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorceasrd.wechain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorceasrd.wiot.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorceasrd.yingjikuaijie1.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorceasrd.yingjikuaijie2.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorceasrd.yingjikuaijie3.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorceasrd.yingjikuaijie4.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorceasrd.yingjiyoupin6.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorceasrd.yingjiyoupin8.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseacsrd.masorceasrd.yxfspd.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masoreccsrd.1235439.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masoreccsrd.1354387.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masoreccsrd.2558878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masoreccsrd.3838833.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masoreccsrd.4535888.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masoreccsrd.6687784.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masoreccsrd.6786787.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masoreccsrd.6997854.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masoreccsrd.6997887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masoreccsrd.9697555.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masoreccsrd.aiex.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masoreccsrd.axs.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200006930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masoreccsrd.bchain.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200006931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masoreccsrd.bitpay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masoreccsrd.cehua.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200006933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masoreccsrd.coinbig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masoreccsrd.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masoreccsrd.dingzhi.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200006936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masoreccsrd.diot.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masoreccsrd.eefi.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200006938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masoreccsrd.jiami.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200006939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masoreccsrd.junhan.wang"; content:"Host"; http_header; classtype:attempted-recon; sid:200006940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masoreccsrd.nftcn.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masoreccsrd.pinggu.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200006942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masoreccsrd.platon.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200006943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masoreccsrd.rolling41.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masoreccsrd.sbfaka.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masoreccsrd.shangpin.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200006946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masoreccsrd.suifeng.asia"; content:"Host"; http_header; classtype:attempted-recon; sid:200006947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masoreccsrd.wangcaitongbao6.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masoreccsrd.wangcaitongbao7.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masoreccsrd.wechain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masoreccsrd.wiot.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masoreccsrd.yingjikuaijie1.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masoreccsrd.yingjikuaijie2.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masoreccsrd.yingjikuaijie3.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masoreccsrd.yingjikuaijie4.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masoreccsrd.yingjiyoupin6.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masoreccsrd.yingjiyoupin8.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masoreccsrd.yxfspd.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masorecsrd.1235439.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masorecsrd.1354387.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masorecsrd.2558878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masorecsrd.3838833.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masorecsrd.4535888.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masorecsrd.6687784.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masorecsrd.6786787.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masorecsrd.6997854.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masorecsrd.6997887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masorecsrd.9697555.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masorecsrd.aiex.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masorecsrd.axs.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200006970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masorecsrd.bchain.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200006971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masorecsrd.bitpay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masorecsrd.cehua.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200006973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masorecsrd.coconaicha.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masorecsrd.coinbig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masorecsrd.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masorecsrd.dingzhi.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200006977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masorecsrd.diot.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masorecsrd.eefi.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200006979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masorecsrd.jiami.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200006980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masorecsrd.jshdiwje.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masorecsrd.junhan.wang"; content:"Host"; http_header; classtype:attempted-recon; sid:200006982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masorecsrd.nftcn.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masorecsrd.particularly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200006984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masorecsrd.pinggu.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200006985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masorecsrd.platon.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200006986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masorecsrd.rolling41.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masorecsrd.sbfaka.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200006988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masorecsrd.shangpin.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200006989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masorecsrd.suifeng.asia"; content:"Host"; http_header; classtype:attempted-recon; sid:200006990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masorecsrd.wangcaitongbao6.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masorecsrd.wangcaitongbao7.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masorecsrd.wechain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masorecsrd.wiot.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200006994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masorecsrd.xiaomi8.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200006995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masorecsrd.yingjikuaijie1.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masorecsrd.yingjikuaijie2.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masorecsrd.yingjikuaijie3.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masorecsrd.yingjikuaijie4.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200006999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masorecsrd.yingjiyoupin6.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masorecsrd.yingjiyoupin8.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masorseasrd.masorecsrd.yxfspd.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"masterdetail.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200007003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mastologia.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200007004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"matamask.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200007005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"match.lookatmynewphotos.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mathelin-teinture-tissus.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"matkaom.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"matketlaceaxelndinide.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maxchemicals.com.np"; content:"Host"; http_header; classtype:attempted-recon; sid:200007010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maximazer-inv.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maximazer-inv.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maxis-winner-2020.webs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"maya.in.ua"; content:"Host"; http_header; classtype:attempted-recon; sid:200007014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mayoristaalapublica.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mayrezult.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200007016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mb241assist.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200007017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mbarquitecto.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200007018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mbcp-restaurar-acesso.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mbt3ank.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mbt3ank.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mc-488f839d-5c25-46b8-a4ee-140400-headless-fd1.azurefd.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mccarthyelectrical.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mcconcep.cluster005.ovh.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mchganistore.solofolio.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mcsr.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200007026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"md-3.whb.tempwebhost.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mdavendas.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200007028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mdexs.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200007029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mdurucan.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mdzxpodz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meaca.go.ug"; content:"Host"; http_header; classtype:attempted-recon; sid:200007032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meaghanmforte-calculatemyclosingcosts.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"medelinahealth.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"media-blog-b52ba4.ingress-earth.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200007035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"medicalwl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"medidata.pjnet.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200007037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"medidata.ufcontent.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"medo.world"; content:"Host"; http_header; classtype:attempted-recon; sid:200007039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"medzax95vhost214753.lowhost.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200007040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meeting-23900123090123.bitbucket.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200007041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meettahelpp.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"megaparseonalse.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meine-okay99.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meine-postbank-de.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meine-pstbnk-update-html101.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meine-pstbnk-update-html101.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mejtiqp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"membersiberostartheclub.com.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200007049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meme-lisbosbo.comme-a-lisbonne.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"memoriamapu.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200007051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mens.vn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"merdas.ir"; content:"Host"; http_header; classtype:attempted-recon; sid:200007053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mesacanada.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mesdesjunhoamerican.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"message-webapp2242022-1311426938.cos.ap-nanjing.myqcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"messagecenter.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200007057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"messagerie-orange210.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"messagerievocaleorange.podia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"messari.cx"; content:"Host"; http_header; classtype:attempted-recon; sid:200007060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mestertignseekjet4.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mestertignseekjet5.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mestertignseekjet6.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mestredaobra.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-adsupport.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-adsupport.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-browser.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-desk-28975.herokuapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-desk-28976.herokuapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meta-support-48812.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metacenter.com.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200007071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metaciteacn.noisy-scene-1d5c.rcvrypegsfty.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200007072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metadopt.minti.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200007073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metaeaglefc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamakwallet.unaux.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask-io.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask-nft.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200007077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask-partenaires.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask-ri.jatra-app.infinityfreeapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask-wallet-security.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask-wallet-verification.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask-wallet.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200007082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask.bar"; content:"Host"; http_header; classtype:attempted-recon; sid:200007083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask.cash"; content:"Host"; http_header; classtype:attempted-recon; sid:200007084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask.cm"; content:"Host"; http_header; classtype:attempted-recon; sid:200007085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask.com-xyzxy.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask.en.download.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200007087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask.financial"; content:"Host"; http_header; classtype:attempted-recon; sid:200007088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask.study"; content:"Host"; http_header; classtype:attempted-recon; sid:200007089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask.usdtvip.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200007090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask004.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamask02.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamaskdownloadandroid.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamaskey.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamaskhelp.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200007095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamaskios.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamaskn.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamaskpay.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamaskpay.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamasks-validate.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamasks.vip"; content:"Host"; http_header; classtype:attempted-recon; sid:200007101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamaskwalle.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamaskwallet.easy.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200007103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamesk.world"; content:"Host"; http_header; classtype:attempted-recon; sid:200007104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metamsk.world"; content:"Host"; http_header; classtype:attempted-recon; sid:200007105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metananach.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metaoperations-inc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metarmask.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200007108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metarnesk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metaverifizaiona.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metaverifizaiona.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metropolisclouds.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"metteur.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200007113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meufgts.app.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200007114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"meusabor.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200007115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mewscc09.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200007116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mexpup.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mfacebook.blogspot.com.cy"; content:"Host"; http_header; classtype:attempted-recon; sid:200007118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mfacebook.blogspot.lt"; content:"Host"; http_header; classtype:attempted-recon; sid:200007119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mfacebook.blogspot.rs"; content:"Host"; http_header; classtype:attempted-recon; sid:200007120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mghcxd.arcaraf.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mhbgv.to62dkj.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mhdhddudhdbdhjdjh.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mhgfv.wukdmid.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"miasuke.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mibancocrece.com.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200007126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mic-cinautheticate.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200007127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micro-device-file-folder.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micro-device-file-folder.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micro-drive-login-share-file.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micro-drive-login-share-file.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micro-file-share-folder-dbtc.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micro-file-share-folder-dbtc.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micro-file-share-folder-detc.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micro-file-share-folder-detc.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micro-file-share-folder-mctc.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micro-file-share-folder-mctc.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micro-file-share-folder-shtc.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micro-file-share-folder-shtc.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micro-identification.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micro-login-document-share.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micro-login-document-share.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micro-login-share-file-device.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micro-login-share-file-device.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micro50495045045.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micro50495045045.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"microadobe.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"microcav.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200007148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"microsfotoffice86572.jogengineerin.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200007149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"microsoft-azuresecurelogin.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"microsoft-outlook365.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"microsoft.bijl.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200007152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"microsoft2210.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"microsoftoffice365credentials.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"microsoftofficesecure.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"microsoftonlineonedrive.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"microsoftsharepointportal.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"microsoftwebserver.mfs.gg"; content:"Host"; http_header; classtype:attempted-recon; sid:200007158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"micuenta01.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200007159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"midas.com.ec"; content:"Host"; http_header; classtype:attempted-recon; sid:200007160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"midwesthomesinc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mikesradios.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"millenialadvisor.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"milwaukee8.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"milyoner.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200007165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"min-kredinor.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200007166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"minargamerbd.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mindfree.co.za"; content:"Host"; http_header; classtype:attempted-recon; sid:200007168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"minerlee.topijerami.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200007169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mingming20160152.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200007170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"miniurl.ws"; content:"Host"; http_header; classtype:attempted-recon; sid:200007171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mintbymia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mintnft-cheap.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mintwagger.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mircrosofti.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mirrorfamily-ak.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200007176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"misrpharma.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"missionshashank.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mistabadseed.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"misty-band-9f1c.driveloadve.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200007180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"misty-base-2a16.dappy0542-mails-files1101.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200007181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"misty-credit-a641.george72972323.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200007182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mityurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjayme9jdg9izxixmjeydgg.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjayme9jdg9izxiymjnyza.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymu1heta1dgg.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymu1hetezmtj0aa.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymu1hetgym3jk.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymu1hetizmtl0aa.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymu1hetqymhro.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymu1hetu3dgg.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymu1hetuymhro.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymu5vdmvtymvymji5dgg.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymu5vdmvtymvymtexdgg.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymuf1z3vzdde4mtf0aa.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymufwcmlsmde5dgg.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymup1bhk0mtf0aa.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymup1bhk1mtr0aa.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymup1bhkzmtn0aa.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymup1bmu0mtf0aa.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymup1bmuymzfzda.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymuphbnvhcnkxmzv0aa.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymurly2vtymvymjiyn3ro.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjaymvnlchrlbwjlcjizmxn0.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mjhbv.rjcaqxg.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mkfsolucoes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mlenergiasolar.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200007207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mma99a.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mmm2g-ayaaa-aaaad-qcvaa-cai.ic.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200007209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mmrjmu.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mms-escrow-storage-0utl00k.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mmsnoreplysms.flazio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mmusictv.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mn-finamce.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mnbj550.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mobiadvanced.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mobile-suica-jn84hg85h0fe8dc4b036f022fed40017be1.zcmogtotc.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200007217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mobile.meta-pages.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200007218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mobile.solcidesemboisomesdejulio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mobileapptools.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"modelofotosonasegarra.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"momsfiesta.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mon-token.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"monespaca.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"monirshouvo.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200007225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"monker.bwbkqud.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"monyeward.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"monzo.login-cancel.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"moonfusionrestaurant.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200007229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"morindd.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"morning-glitter-2e87.filedownjs.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200007231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"moveislojinha-app.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mowcn-au-pay.amlxiyn.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mowcn-au-pay.axjxohq.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mowcn-au-pay.bczvrey.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mowcn-au-pay.dxqdiew.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mowcn-au-pay.fqcrm.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mowcn-au-pay.gswvtlp.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mowcn-au-pay.gxgrlkb.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mowcn-au-pay.izzndwg.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mowcn-au-pay.jalorkf.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mowcn-au-pay.jqcrm.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mowcn-au-pay.luaifxa.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mowcn-au-pay.lvwulwh.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mowcn-au-pay.meukphp.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mowcn-au-pay.mgcrm.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mowcn-au-pay.nrggqcn.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mowcn-au-pay.pofirjj.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mowcn-au-pay.pvmlaah.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mowcn-au-pay.qhvpvdl.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mowcn-au-pay.rdrtzzt.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mowcn-au-pay.rlkygyc.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mowcn-au-pay.rxwnubs.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mowcn-au-pay.secrm.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mowcn-au-pay.sgyfwla.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mowcn-au-pay.sleyiel.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mowcn-au-pay.tabuaev.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mowcn-au-pay.tdnjdjg.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mowcn-au-pay.tngqntw.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mowcn-au-pay.unaewak.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mowcn-au-pay.vpdgdqe.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mowcn-au-pay.xiuipbv.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mowcn-au-pay.ycxwrta.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mowcn-au-pay.zkkcnbj.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"moyapaczka.cloud"; content:"Host"; http_header; classtype:attempted-recon; sid:200007265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mp-logincliente.siteprofissional.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mp.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mpaleiriitoken2020399.pagina-oficial.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mpbirdcontrol.qc.ca"; content:"Host"; http_header; classtype:attempted-recon; sid:200007269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mpsienaprotezionefrodi.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mpsienaserviziostorno.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mrskateosebor.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ms-hubinternational-storage-0utl00k.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ms-hubinternational-storage-0utl00k.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ms2-escrow-storage-0utl00k.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"msafee.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"msc-doelsach.at"; content:"Host"; http_header; classtype:attempted-recon; sid:200007277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"msofficemessagescenter-1.mfs.gg"; content:"Host"; http_header; classtype:attempted-recon; sid:200007278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"msomclogin.innfinancial.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mt008.herokuapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtask-pr01.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtb-247-sec00.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtb-247-sec00.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtb-secured02a.myftp.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200007284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtb0support.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtb3service.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtb3unrecognize.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtb5nk.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtb5nk.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtba9k.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtbnk3.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtbnk7.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtbnk7.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtbnxk.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtbnxk.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtbonline-6.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtbonline-6.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtbonline-7.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtbonline-o.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtbonline-o.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtbtwe.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtbxnk.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtbxnk.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtroqsec.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtrqrsc1.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mtrsteel.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mub.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200007307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"much-jqosp.cloud"; content:"Host"; http_header; classtype:attempted-recon; sid:200007308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mudd.marpuasanotice.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200007309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"muddy-ayya.topijerami.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200007310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"muddy-dawn-b613.sharepoinx.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200007311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mueslisvvap.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mueslisvvap.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"multibankweb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"muniporoy.gob.pe"; content:"Host"; http_header; classtype:attempted-recon; sid:200007315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"murasa.bwbkqud.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200007316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"murlidharrope.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mvcas.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mvellolandingpage.azurewebsites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mwemml.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mwemml.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mxrr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mxtb3nk.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mxtb3nk.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-account-orange.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-arnazno-prime6-singin6.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200007326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-bithumb.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-business-105842-105673.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200007328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-cle-account-cyon-ch-cle.pablo-pb.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200007329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-gmail.ir"; content:"Host"; http_header; classtype:attempted-recon; sid:200007330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-site-104707-106142.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my-site-silahkan-konfirmas-akun-anda088.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my.commbank.com.au.lebnewsonline.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my.heyform.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my.jeb.co-jp-myjasaocnb.egrmsod.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200007335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my.jeb.co-jp-myjasaocnb.odevgmu.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200007336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my.jeb.co-jp-myjasaocnb.tigafcj.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200007337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my.jeb.co-jp-myjasaocnb.ujcnrwu.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200007338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my.jeb.co-jp-myjasaocnb.vkpjmeh.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200007339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my.jeb.co-jp-myjasaocnb.vylmxgy.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200007340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my.jeb.co-jp-myjasaocnb.zgtootp.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200007341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my.jeb.co-jp-myjasaocnsb.gxlxqeb.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200007342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my.jeb.co-jp-myjasaocnsb.hfwaynj.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200007343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my.jeb.co-jp-myjasaocnsb.iwkdlfm.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200007344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my.jeb.co-jp-myjasaocnsb.jmhjpbl.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200007345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my.jeb.co-jp-myjasaocnsb.jquzmcm.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200007346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my.jeb.co-jp-myjasaocnsb.ssslhif.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200007347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my.jeb.co-jp-myjasaocnsb.tigafcj.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200007348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my.job.co-jp-myjascaoseb.iwkdlfm.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200007349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my.job.co-jp-myjascaoseb.jquzmcm.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200007350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my.job.co-jp-myjascaoseb.kzjioix.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200007351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my.job.co-jp-myjascaoseb.odevgmu.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200007352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my.job.co-jp-myjascaoseb.vylmxgy.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200007353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my.job.co-jp-myjascaosseb.oxtcwle.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200007354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"my.job.co-jp-myjascaosseb.qyfiqci.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200007355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myamazon.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200007356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myappbtsecurebusiness.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200007357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myappvalidations.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mybperpagelive.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mybroadband7140002.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200007360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mydappswalletconnect.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mydefinodeprotocol.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mydooog.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myee-updatebilling.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200007364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myerudition.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myetherwallet-app.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myiccu.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200007367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myiccu.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200007368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacacsoeb.myjacaasoeb.anriplt.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200007369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacacsoeb.myjacaasoeb.apauokq.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200007370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacacsoeb.myjacaasoeb.kworjjo.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200007371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacacsoeb.myjacaasoeb.pxecpbo.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200007372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacacsoeb.myjaccaasoeb.kccjpky.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200007373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacacsoeb.myjaccaasoeb.lvulavr.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200007374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacacsoeb.myjaccaasoeb.lxbbwwq.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200007375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacacsoeb.myjaccaasoeb.nhibzec.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200007376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacacsoeb.myjaccaasoeb.qhjwkyv.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200007377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacacsoeb.myjaccaasoeb.zrqkwlu.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200007378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacocaasoeb.1235439.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacocaasoeb.1354387.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacocaasoeb.2558878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacocaasoeb.3838833.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacocaasoeb.4535888.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacocaasoeb.6687784.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacocaasoeb.6786787.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacocaasoeb.6997854.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacocaasoeb.6997887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacocaasoeb.9697555.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacocaasoeb.aiex.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacocaasoeb.axs.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200007390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacocaasoeb.bchain.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200007391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacocaasoeb.bitpay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacocaasoeb.cehua.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200007393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacocaasoeb.coinbig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacocaasoeb.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacocaasoeb.dingzhi.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200007396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacocaasoeb.diot.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacocaasoeb.eefi.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200007398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacocaasoeb.jiami.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200007399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacocaasoeb.junhan.wang"; content:"Host"; http_header; classtype:attempted-recon; sid:200007400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacocaasoeb.koplsia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacocaasoeb.nftcn.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacocaasoeb.pinggu.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200007403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacocaasoeb.platon.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200007404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacocaasoeb.rolling41.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacocaasoeb.sbfaka.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacocaasoeb.shangpin.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200007407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacocaasoeb.suifeng.asia"; content:"Host"; http_header; classtype:attempted-recon; sid:200007408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacocaasoeb.uvwxyz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacocaasoeb.wangcaitongbao6.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacocaasoeb.wangcaitongbao7.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacocaasoeb.wechain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacocaasoeb.wiot.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacocaasoeb.yingjikuaijie1.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacocaasoeb.yingjikuaijie2.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacocaasoeb.yingjikuaijie3.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacocaasoeb.yingjikuaijie4.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacocaasoeb.yingjiyoupin6.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacocaasoeb.yingjiyoupin8.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacocaasoeb.yxfspd.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacoccaasoeb.1235439.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacoccaasoeb.1354387.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacoccaasoeb.2558878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacoccaasoeb.3838833.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacoccaasoeb.4535888.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacoccaasoeb.6687784.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacoccaasoeb.6786787.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacoccaasoeb.6997854.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacoccaasoeb.6997887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacoccaasoeb.9697555.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacoccaasoeb.aiex.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacoccaasoeb.axs.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200007432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacoccaasoeb.bchain.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200007433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacoccaasoeb.bitpay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacoccaasoeb.cehua.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200007435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacoccaasoeb.coconaicha.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacoccaasoeb.coinbig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacoccaasoeb.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacoccaasoeb.dingzhi.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200007439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacoccaasoeb.diot.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacoccaasoeb.eefi.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200007441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacoccaasoeb.jiami.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200007442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacoccaasoeb.junhan.wang"; content:"Host"; http_header; classtype:attempted-recon; sid:200007443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacoccaasoeb.koplsib.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacoccaasoeb.nftcn.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacoccaasoeb.particularly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacoccaasoeb.pinggu.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200007447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacoccaasoeb.platon.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200007448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacoccaasoeb.rolling41.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacoccaasoeb.sbfaka.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacoccaasoeb.shangpin.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200007451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacoccaasoeb.suifeng.asia"; content:"Host"; http_header; classtype:attempted-recon; sid:200007452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacoccaasoeb.wangcaitongbao6.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacoccaasoeb.wangcaitongbao7.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacoccaasoeb.wechain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacoccaasoeb.wiot.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacoccaasoeb.yingjikuaijie1.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacoccaasoeb.yingjikuaijie2.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacoccaasoeb.yingjikuaijie3.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacoccaasoeb.yingjikuaijie4.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacoccaasoeb.yingjiyoupin6.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacoccaasoeb.yingjiyoupin8.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasecsoeb.myjacoccaasoeb.yxfspd.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccoasoeb.1235439.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccoasoeb.1354387.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccoasoeb.2558878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccoasoeb.3838833.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccoasoeb.4535888.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccoasoeb.6687784.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccoasoeb.6786787.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccoasoeb.6997854.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccoasoeb.6997887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccoasoeb.9697555.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccoasoeb.aiex.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccoasoeb.axs.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200007475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccoasoeb.bchain.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200007476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccoasoeb.bitpay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccoasoeb.cehua.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200007478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccoasoeb.coinbig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccoasoeb.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccoasoeb.dingzhi.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200007481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccoasoeb.diot.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccoasoeb.djkskoc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccoasoeb.eefi.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200007484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccoasoeb.jiami.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200007485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccoasoeb.junhan.wang"; content:"Host"; http_header; classtype:attempted-recon; sid:200007486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccoasoeb.nftcn.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccoasoeb.pinggu.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200007488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccoasoeb.platon.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200007489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccoasoeb.rolling41.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccoasoeb.sbfaka.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccoasoeb.shangpin.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200007492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccoasoeb.suifeng.asia"; content:"Host"; http_header; classtype:attempted-recon; sid:200007493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccoasoeb.wangcaitongbao6.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccoasoeb.wangcaitongbao7.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccoasoeb.wechain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccoasoeb.wiot.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccoasoeb.xiaomi8.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200007498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccoasoeb.yingjikuaijie1.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccoasoeb.yingjikuaijie2.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccoasoeb.yingjikuaijie3.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccoasoeb.yingjikuaijie4.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccoasoeb.yingjiyoupin6.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccoasoeb.yingjiyoupin8.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccoasoeb.yxfspd.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccocasoeb.1235439.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccocasoeb.1354387.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccocasoeb.2558878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccocasoeb.3838833.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccocasoeb.4535888.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccocasoeb.6687784.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccocasoeb.6786787.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccocasoeb.6997854.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccocasoeb.6997887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccocasoeb.9697555.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccocasoeb.aiex.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccocasoeb.axs.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200007517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccocasoeb.bchain.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200007518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccocasoeb.bitpay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccocasoeb.cehua.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200007520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccocasoeb.coinbig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccocasoeb.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccocasoeb.dingzhi.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200007523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccocasoeb.diot.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccocasoeb.eefi.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200007525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccocasoeb.jiami.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200007526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccocasoeb.jshdiwje.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccocasoeb.junhan.wang"; content:"Host"; http_header; classtype:attempted-recon; sid:200007528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccocasoeb.koplsia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccocasoeb.pinggu.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200007530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccocasoeb.platon.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200007531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccocasoeb.rolling41.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccocasoeb.sbfaka.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccocasoeb.shangpin.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200007534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccocasoeb.suifeng.asia"; content:"Host"; http_header; classtype:attempted-recon; sid:200007535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccocasoeb.wangcaitongbao6.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccocasoeb.wechain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccocasoeb.wiot.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccocasoeb.yingjikuaijie1.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccocasoeb.yingjikuaijie2.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccocasoeb.yingjikuaijie3.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccocasoeb.yingjikuaijie4.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccocasoeb.yingjiyoupin6.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccocasoeb.yingjiyoupin8.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacasesoeb.myjaccocasoeb.yxfspd.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsasoesb-caosmsoeb.rwmcr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsasoesb-caosmsoeb.wkbakq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsasoesb-caosmsoeb.wmysah.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsasoesb-caosmsoeb.wotygl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsasoesb-caosmsoeb.wozavw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsasoesb-caosmsoeb.xubnkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsasoesb-caosmsoeb.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsasoesb-caosmsoeb.ybmkwa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsasoesb-caosmsoeb.yfnvfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsasoesb-caosmsoeb.yqggww.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsasoesb-caosmsoeb.ytbspo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsasoesb-caosmsoeb.yyyuwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsasoesb-caosmsoeb.zohlkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsasoesb-caosmsoeb.zrzckw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsasoesb-caosmsoeb.zusrue.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjaccaasoeb.1235439.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjaccaasoeb.1354387.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjaccaasoeb.2558878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjaccaasoeb.3838833.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjaccaasoeb.4535888.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjaccaasoeb.6687784.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjaccaasoeb.6786787.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjaccaasoeb.6997854.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjaccaasoeb.6997887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjaccaasoeb.9697555.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjaccaasoeb.aiex.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjaccaasoeb.axs.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200007572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjaccaasoeb.bchain.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200007573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjaccaasoeb.bitpay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjaccaasoeb.cehua.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200007575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjaccaasoeb.coinbig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjaccaasoeb.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjaccaasoeb.dingzhi.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200007578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjaccaasoeb.diot.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjaccaasoeb.djkskoc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjaccaasoeb.eefi.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200007581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjaccaasoeb.jiami.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200007582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjaccaasoeb.koplsib.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjaccaasoeb.nftcn.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjaccaasoeb.pinggu.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200007585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjaccaasoeb.platon.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200007586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjaccaasoeb.rolling41.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjaccaasoeb.sbfaka.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjaccaasoeb.shangpin.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200007589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjaccaasoeb.suifeng.asia"; content:"Host"; http_header; classtype:attempted-recon; sid:200007590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjaccaasoeb.uvwxyz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjaccaasoeb.wangcaitongbao6.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjaccaasoeb.wangcaitongbao7.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjaccaasoeb.wechain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjaccaasoeb.wiot.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjaccaasoeb.yanjishoukuai10.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200007596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjaccaasoeb.yingjikuaijie1.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjaccaasoeb.yingjikuaijie2.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjaccaasoeb.yingjikuaijie3.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjaccaasoeb.yingjikuaijie4.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjaccaasoeb.yingjiyoupin6.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjaccaasoeb.yingjiyoupin8.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjaccaasoeb.yxfspd.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjacccaasoeb.1235439.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjacccaasoeb.1354387.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjacccaasoeb.2558878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjacccaasoeb.3838833.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjacccaasoeb.4535888.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjacccaasoeb.6687784.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjacccaasoeb.6786787.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjacccaasoeb.6997854.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjacccaasoeb.6997887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjacccaasoeb.9697555.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjacccaasoeb.aiex.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjacccaasoeb.axs.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200007615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjacccaasoeb.bchain.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200007616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjacccaasoeb.bitpay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjacccaasoeb.cehua.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200007618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjacccaasoeb.coconaicha.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjacccaasoeb.coinbig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjacccaasoeb.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjacccaasoeb.dingzhi.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200007622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjacccaasoeb.diot.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjacccaasoeb.djkskoc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjacccaasoeb.eefi.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200007625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjacccaasoeb.jiami.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200007626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjacccaasoeb.junhan.wang"; content:"Host"; http_header; classtype:attempted-recon; sid:200007627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjacccaasoeb.koplsia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjacccaasoeb.nftcn.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjacccaasoeb.pinggu.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200007630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjacccaasoeb.platon.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200007631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjacccaasoeb.rolling41.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjacccaasoeb.sbfaka.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjacccaasoeb.shangpin.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200007634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjacccaasoeb.suifeng.asia"; content:"Host"; http_header; classtype:attempted-recon; sid:200007635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjacccaasoeb.wangcaitongbao6.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjacccaasoeb.wangcaitongbao7.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjacccaasoeb.wechain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjacccaasoeb.wiot.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjacccaasoeb.yanjishoukuai10.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200007640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjacccaasoeb.yingjikuaijie1.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjacccaasoeb.yingjikuaijie2.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjacccaasoeb.yingjikuaijie3.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjacccaasoeb.yingjikuaijie4.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjacccaasoeb.yingjiyoupin6.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjacccaasoeb.yingjiyoupin8.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseacsoeb.myjacccaasoeb.yxfspd.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjaccasoeb.1235439.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjaccasoeb.1354387.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjaccasoeb.2558878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjaccasoeb.3838833.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjaccasoeb.4535888.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjaccasoeb.6687784.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjaccasoeb.6786787.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjaccasoeb.6997854.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjaccasoeb.6997887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjaccasoeb.9697555.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjaccasoeb.aiex.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjaccasoeb.axs.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200007659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjaccasoeb.bchain.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200007660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjaccasoeb.bitpay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjaccasoeb.cehua.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200007662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjaccasoeb.coinbig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjaccasoeb.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjaccasoeb.dingzhi.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200007665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjaccasoeb.diot.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjaccasoeb.eefi.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200007667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjaccasoeb.jiami.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200007668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjaccasoeb.junhan.wang"; content:"Host"; http_header; classtype:attempted-recon; sid:200007669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjaccasoeb.nftcn.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjaccasoeb.pinggu.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200007671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjaccasoeb.rolling41.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjaccasoeb.sbfaka.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjaccasoeb.shangpin.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200007674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjaccasoeb.suifeng.asia"; content:"Host"; http_header; classtype:attempted-recon; sid:200007675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjaccasoeb.uvwxyz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjaccasoeb.wangcaitongbao6.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjaccasoeb.wangcaitongbao7.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjaccasoeb.wechain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjaccasoeb.wiot.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjaccasoeb.yanjishoukuai5.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200007681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjaccasoeb.yingjikuaijie1.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjaccasoeb.yingjikuaijie2.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjaccasoeb.yingjikuaijie3.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjaccasoeb.yingjikuaijie4.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjaccasoeb.yingjiyoupin6.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjaccasoeb.yingjiyoupin8.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjaccasoeb.yxfspd.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjacccasoeb.1235439.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjacccasoeb.1354387.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjacccasoeb.2558878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjacccasoeb.3838833.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjacccasoeb.4535888.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjacccasoeb.6687784.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjacccasoeb.6786787.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjacccasoeb.6997854.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjacccasoeb.6997887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjacccasoeb.9697555.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjacccasoeb.aiex.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjacccasoeb.axs.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200007700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjacccasoeb.bchain.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200007701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjacccasoeb.bitpay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjacccasoeb.cehua.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200007703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjacccasoeb.coconaicha.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjacccasoeb.coinbig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjacccasoeb.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjacccasoeb.dingzhi.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200007707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjacccasoeb.diot.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjacccasoeb.eefi.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200007709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjacccasoeb.jiami.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200007710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjacccasoeb.junhan.wang"; content:"Host"; http_header; classtype:attempted-recon; sid:200007711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjacccasoeb.nftcn.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjacccasoeb.pinggu.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200007713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjacccasoeb.platon.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200007714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjacccasoeb.rolling41.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjacccasoeb.sbfaka.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjacccasoeb.shangpin.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200007717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjacccasoeb.suifeng.asia"; content:"Host"; http_header; classtype:attempted-recon; sid:200007718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjacccasoeb.wangcaitongbao6.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjacccasoeb.wangcaitongbao7.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjacccasoeb.wechain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjacccasoeb.wiot.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjacccasoeb.yingjikuaijie1.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjacccasoeb.yingjikuaijie2.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjacccasoeb.yingjikuaijie3.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjacccasoeb.yingjikuaijie4.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjacccasoeb.yingjiyoupin6.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjacccasoeb.yingjiyoupin8.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200007728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacseasoeb.myjacccasoeb.yxfspd.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200007729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsorb.mykascoeb.adqdwg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsorb.mykascoeb.bmqbxi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsorb.mykascoeb.cbmikk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsorb.mykascoeb.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsorb.mykascoeb.dhvprp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsorb.mykascoeb.dlsefg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsorb.mykascoeb.dpcijt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsorb.mykascoeb.dqbskq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsorb.mykascoeb.dwvkhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsorb.mykascoeb.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsorb.mykascoeb.ehbrwp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsorb.mykascoeb.eiaohy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsorb.mykascoeb.eiblhv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsorb.mykascoeb.ejxxpq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsorb.mykascoeb.fgopqn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsorb.mykascoeb.fxojqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsorb.mykascoeb.gqnrcz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsorb.mykascoeb.gxisfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsorb.mykascoeb.hfblsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsorb.mykascoeb.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsorb.mykascoeb.iahbzj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsorb.mykascoeb.ibjlwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsorb.mykascoeb.ikmkwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsorb.mykascoeb.iwwocw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsorb.mykascoeb.jaovxc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsorb.mykascoeb.jaubvr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsorb.mykascoeb.jgaooc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsorb.mykascoeb.joriqb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsorb.mykascoeb.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsorb.mykascoeb.lxqslk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsorb.mykascoeb.okpufh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsorb.mykascoeb.ovbfsv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsorb.mykascoeb.owkcmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsorb.mykascoeb.ozicyo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsorb.mykascoeb.pczkai.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsorb.mykascoeb.pheudi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsorb.mykascoeb.pwzivx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsorb.mykascoeb.rabbhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsorb.mykascoeb.rbtuib.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsorb.mykascoeb.xbbfqp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsorb.mykascoeb.xhaivw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsorb.mykascoeb.xlftxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsorb.mykascoeb.xlokjz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsorb.mykascoeb.xnskxw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsorb.mykascoeb.xvebfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsorb.mykascoeb.yiyingzf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsorb.mykascoeb.ypznyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsorb.mykascoeb.ywmdmi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsorb.mykascoeb.zbomvh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsorb.mykascoeb.zbqfwh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsorb.mykascoeb.zfeixc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjacsorb.mykascoeb.zlrrpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesscsosceob.aasaeasneoscb.rcapss.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesscsosceob.aasaeasneoscb.rhxhhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesscsosceob.aasaeasneoscb.rusnrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesscsosceob.aasaeasneoscb.twjzsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaesscsosceob.aasaeasneoscb.uietyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaessosceob.aasnsaeoscb.rlyndd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaessosceob.aasnsaeoscb.scrqdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaessosceob.aasnsaeoscb.tvqwui.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaessosceob.aasnsaeoscb.uudnmz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaocsoeb.myjassceb.ablndk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaocsoeb.myjassceb.agjlyk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaocsoeb.myjassceb.ahatzx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaocsoeb.myjassceb.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaocsoeb.myjassceb.bmozhr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaocsoeb.myjassceb.cbmikk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaocsoeb.myjassceb.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaocsoeb.myjassceb.dborfs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaocsoeb.myjassceb.dlsefg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaocsoeb.myjassceb.dpcijt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaocsoeb.myjassceb.dwvkhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaocsoeb.myjassceb.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaocsoeb.myjassceb.eiblhv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaocsoeb.myjassceb.ejxxpq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaocsoeb.myjassceb.espkgb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaocsoeb.myjassceb.fhcljq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaocsoeb.myjassceb.fodxlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaocsoeb.myjassceb.fxojqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaocsoeb.myjassceb.gsajzb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaocsoeb.myjassceb.hfblsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaocsoeb.myjassceb.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaocsoeb.myjassceb.iahbzj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaocsoeb.myjassceb.ibjlwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaocsoeb.myjassceb.ibyljb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaocsoeb.myjassceb.iesklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaocsoeb.myjassceb.ivupqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaocsoeb.myjassceb.jaovxc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaocsoeb.myjassceb.jcxaec.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaocsoeb.myjassceb.jgahwi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaocsoeb.myjassceb.kdrcni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaocsoeb.myjassceb.kpdmbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaocsoeb.myjassceb.kzadys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaocsoeb.myjassceb.lcjmil.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaocsoeb.myjassceb.lxqslk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaocsoeb.myjassceb.manljw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaocsoeb.myjassceb.meqery.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaocsoeb.myjassceb.mipvrd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaocsoeb.myjassceb.nmlubc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaocsoeb.myjassceb.okpufh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaocsoeb.myjassceb.oqgpdd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaocsoeb.myjassceb.ovbfsv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaocsoeb.myjassceb.pczkai.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaocsoeb.myjassceb.pdmvfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaocsoeb.myjassceb.piposm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaocsoeb.myjassceb.xbbfqp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaocsoeb.myjassceb.xhaivw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaocsoeb.myjassceb.xnskxw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaocsoeb.myjassceb.yaaabg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaocsoeb.myjassceb.ypznyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaocsoeb.myjassceb.zbqfwh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaocsoeb.myjassceb.zhxqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjaocsoeb.myjassceb.zipdjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyccaojarsoasoceoseaascsoeb.12380978.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyccaojarsoasoceoseaascsoeb.1239978.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyccaojarsoasoceoseaascsoeb.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyccaojarsoasoceoseaascsoeb.6978458.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyccaojarsoasoceoseaascsoeb.7786945.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyccaojarsoasoceoseaascsoeb.7997845.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyccaojarsoasoceoseaascsoeb.93544117.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyccaojarsoasoceoseaascsoeb.blyqdj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyccaojarsoasoceoseaascsoeb.duikdo.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200007851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyccaojarsoasoceoseaascsoeb.hdivud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyccaojarsoasoceoseaascsoeb.hdjyfur.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200007853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyccaojarsoasoceoseaascsoeb.ijhojg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyccaojarsoasoceoseaascsoeb.loqjz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyccaojarsoasoceoseaascsoeb.neqnpg.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200007856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyccaojarsoasoceoseaascsoeb.nzvzoq.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200007857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyccaojarsoasoceoseaascsoeb.wjgomb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyccaojarsoasoceoseaascsoeb.xfpmrv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyccaojarsoasoceoseaascsoeb.xybwxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyccaojarsoasoceoseaascsoeb.xzeejb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyccaojarsoasoceoseaascsoeb.yangyang44.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200007862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyccaojarsoasoceoseaascsoeb.ykbzoq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyccaojarsoasoceoseaascsoeb.ynytah.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyccaojarsoasoceoseaascsoeb.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyccaojarsoasoceoseaascsoeb.yqpqaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyccaojarsoasoceoseaascsoeb.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyccaojarsoasoceoseacsoeb.12380978.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyccaojarsoasoceoseacsoeb.1239978.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyccaojarsoasoceoseacsoeb.1366778.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyccaojarsoasoceoseacsoeb.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyccaojarsoasoceoseacsoeb.5633845.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyccaojarsoasoceoseacsoeb.6378791.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyccaojarsoasoceoseacsoeb.93544117.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyccaojarsoasoceoseacsoeb.9978754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyccaojarsoasoceoseacsoeb.ankdujfkx.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200007876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyccaojarsoasoceoseacsoeb.auxfvv.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200007877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyccaojarsoasoceoseacsoeb.aymaus.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200007878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyccaojarsoasoceoseacsoeb.blyqdj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyccaojarsoasoceoseacsoeb.duikdo.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200007880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyccaojarsoasoceoseacsoeb.eaosey.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyccaojarsoasoceoseacsoeb.jbqbcfxgt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyccaojarsoasoceoseacsoeb.nedpvy.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200007883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyccaojarsoasoceoseacsoeb.nnawja.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyccaojarsoasoceoseacsoeb.wjgomb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyccaojarsoasoceoseacsoeb.wogwe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyccaojarsoasoceoseacsoeb.xfpmrv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyccaojarsoasoceoseacsoeb.xybwxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyccaojarsoasoceoseacsoeb.ykbzoq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyccaojarsoasoceoseacsoeb.ynytah.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyccaojarsoasoceoseacsoeb.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyccaojarsoasoceoseacsoeb.yqpqaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyccaojarsoasoceoseacsoeb.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseccsocsoeb.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseccsocsoeb.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseccsocsoeb.6945785.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseccsocsoeb.6978458.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseccsocsoeb.7786945.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseccsocsoeb.93544117.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseccsocsoeb.9784585.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseccsocsoeb.blyqdj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseccsocsoeb.ijhojg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseccsocsoeb.ilblz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseccsocsoeb.njlrxn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseccsocsoeb.wjgomb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseccsocsoeb.wogwe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseccsocsoeb.xfpmrv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseccsocsoeb.xybwxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseccsocsoeb.ykbzoq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseccsocsoeb.ynytah.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseccsocsoeb.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseccsocsoeb.yqpqaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseccsocsoeb.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseccsooeb.12380978.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseccsooeb.1239978.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseccsooeb.1366778.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseccsooeb.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseccsooeb.6378791.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseccsooeb.9784585.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseccsooeb.9978754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseccsooeb.aljreh.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200007921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseccsooeb.auxfvv.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200007922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseccsooeb.fzcvxp.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200007923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseccsooeb.ilblz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseccsooeb.nzvzoq.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200007925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseccsooeb.otfake.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseccsooeb.vkzpru.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200007927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseccsooeb.wjgomb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseccsooeb.xfpmrv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseccsooeb.xybwxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseccsooeb.xzeejb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseccsooeb.ykbzoq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseccsooeb.ynytah.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseccsooeb.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseccsooeb.yqpqaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseccsooeb.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceosecsoeb.12380978.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceosecsoeb.239978.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceosecsoeb.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceosecsoeb.3968745.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceosecsoeb.4358879.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceosecsoeb.4687957.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceosecsoeb.5633845.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceosecsoeb.7997845.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceosecsoeb.8676455.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceosecsoeb.93544117.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceosecsoeb.9978754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceosecsoeb.ankdujfkx.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200007948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceosecsoeb.blyqdj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceosecsoeb.ilblz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceosecsoeb.neqnpg.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200007951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceosecsoeb.njlrxn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceosecsoeb.nnawja.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceosecsoeb.nzvzoq.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200007954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceosecsoeb.rfygke.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceosecsoeb.srrnqt.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200007956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceosecsoeb.wjgomb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceosecsoeb.wogwe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceosecsoeb.xfpmrv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceosecsoeb.xybwxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceosecsoeb.xzeejb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceosecsoeb.ykbzoq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceosecsoeb.ynytah.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceosecsoeb.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceosecsoeb.yqpqaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceosecsoeb.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseoeb.1366778.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseoeb.3968745.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseoeb.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseoeb.4687957.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseoeb.5468785.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseoeb.6378791.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseoeb.7786945.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseoeb.9784585.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseoeb.aljreh.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200007975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseoeb.ankdujfkx.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200007976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseoeb.blyqdj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseoeb.eaosey.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseoeb.jbqbcfxgt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseoeb.loqjz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseoeb.nnawja.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseoeb.vkzpru.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200007982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseoeb.wjgomb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseoeb.wogwe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseoeb.xfpmrv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseoeb.xrwetd.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200007986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseoeb.xybwxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseoeb.xzeejb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseoeb.ykbzoq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseoeb.ynytah.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseoeb.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseoeb.yqpqaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseoeb.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200007993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyccaojarsoasocoseaascsoeb.1366778.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyccaojarsoasocoseaascsoeb.239978.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyccaojarsoasocoseaascsoeb.6945785.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyccaojarsoasocoseaascsoeb.8676455.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyccaojarsoasocoseaascsoeb.9784585.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyccaojarsoasocoseaascsoeb.eaosey.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200007999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyccaojarsoasocoseaascsoeb.hdjyfur.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200008000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyccaojarsoasocoseaascsoeb.ijhojg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyccaojarsoasocoseaascsoeb.loqjz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyccaojarsoasocoseaascsoeb.nedpvy.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200008003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyccaojarsoasocoseaascsoeb.njlrxn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyccaojarsoasocoseaascsoeb.otfake.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyccaojarsoasocoseaascsoeb.srrnqt.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200008006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyccaojarsoasocoseaascsoeb.wjgomb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyccaojarsoasocoseaascsoeb.xfpmrv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyccaojarsoasocoseaascsoeb.xybwxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyccaojarsoasocoseaascsoeb.ykbzoq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyccaojarsoasocoseaascsoeb.ynytah.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyccaojarsoasocoseaascsoeb.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyccaojarsoasocoseaascsoeb.yqpqaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyccaojarsoasocoseaascsoeb.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyccaojarsoasocoseacsoeb.1366778.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyccaojarsoasocoseacsoeb.239978.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyccaojarsoasocoseacsoeb.4687957.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyccaojarsoasocoseacsoeb.6378791.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyccaojarsoasocoseacsoeb.6945785.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyccaojarsoasocoseacsoeb.6978458.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyccaojarsoasocoseacsoeb.93544117.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyccaojarsoasocoseacsoeb.adijps.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyccaojarsoasocoseacsoeb.ilqmcz.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200008023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyccaojarsoasocoseacsoeb.loqjz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyccaojarsoasocoseacsoeb.nedpvy.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200008025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyccaojarsoasocoseacsoeb.nzvzoq.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200008026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyccaojarsoasocoseacsoeb.wjgomb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyccaojarsoasocoseacsoeb.xfpmrv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyccaojarsoasocoseacsoeb.xybwxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyccaojarsoasocoseacsoeb.ykbzoq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyccaojarsoasocoseacsoeb.ynytah.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyccaojarsoasocoseacsoeb.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyccaojarsoasocoseacsoeb.yqpqaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyccaojarsoasocoseacsoeb.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseccsocsoeb.3968745.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseccsocsoeb.5468785.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseccsocsoeb.5633845.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseccsocsoeb.6945785.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseccsocsoeb.93544117.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseccsocsoeb.9784585.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseccsocsoeb.ankdujfkx.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200008041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseccsocsoeb.aymaus.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200008042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseccsocsoeb.eaosey.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseccsocsoeb.hdjyfur.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200008044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseccsocsoeb.jbqbcfxgt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseccsocsoeb.neqnpg.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200008046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseccsocsoeb.nnawja.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseccsocsoeb.otfake.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseccsocsoeb.wjgomb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseccsocsoeb.xfpmrv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseccsocsoeb.xrwetd.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200008051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseccsocsoeb.xybwxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseccsocsoeb.ykbzoq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseccsocsoeb.ynytah.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseccsocsoeb.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseccsocsoeb.yqpqaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseccsocsoeb.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseccsooeb.12380978.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseccsooeb.366778.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseccsooeb.3968745.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseccsooeb.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseccsooeb.4358879.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseccsooeb.8676455.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseccsooeb.9978754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseccsooeb.fzcvxp.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200008065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseccsooeb.hdivud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseccsooeb.ilblz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseccsooeb.janbl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseccsooeb.nnawja.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseccsooeb.nzvzoq.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200008070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseccsooeb.srrnqt.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200008071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseccsooeb.vkzpru.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200008072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseccsooeb.wjgomb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseccsooeb.xfpmrv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseccsooeb.xybwxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseccsooeb.yangyang44.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200008076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseccsooeb.ykbzoq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseccsooeb.ynytah.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseccsooeb.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseccsooeb.yqpqaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseccsooeb.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocosecsoeb.1239978.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocosecsoeb.1366778.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocosecsoeb.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocosecsoeb.4687957.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocosecsoeb.5468785.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocosecsoeb.6945785.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocosecsoeb.7786945.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocosecsoeb.93544117.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocosecsoeb.adijps.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocosecsoeb.blyqdj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocosecsoeb.hdivud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocosecsoeb.ijhojg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocosecsoeb.jbqbcfxgt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocosecsoeb.wjgomb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocosecsoeb.wogwe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocosecsoeb.xfpmrv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocosecsoeb.xybwxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocosecsoeb.xzeejb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocosecsoeb.ykbzoq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocosecsoeb.ynytah.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocosecsoeb.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocosecsoeb.yqpqaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocosecsoeb.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseoeb.12380978.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseoeb.1239978.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseoeb.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseoeb.6378791.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseoeb.7786945.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseoeb.9978754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseoeb.adijps.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseoeb.ankdujfkx.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200008112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseoeb.hdjyfur.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200008113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseoeb.hgzklt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseoeb.janbl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseoeb.nedpvy.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200008116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseoeb.njlrxn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseoeb.shzrab.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200008118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseoeb.wjgomb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseoeb.xfpmrv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseoeb.xybwxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseoeb.xzeejb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseoeb.ykbzoq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseoeb.ynytah.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseoeb.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseoeb.yqpqaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseoeb.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccseosmeb.myaoosneb.ahatzx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccseosmeb.myaoosneb.bdlzvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccseosmeb.myaoosneb.bmozhr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccseosmeb.myaoosneb.bmqbxi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccseosmeb.myaoosneb.cormdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccseosmeb.myaoosneb.dborfs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccseosmeb.myaoosneb.dfhxow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccseosmeb.myaoosneb.dlsefg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccseosmeb.myaoosneb.dxjcrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccseosmeb.myaoosneb.eftxrl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccseosmeb.myaoosneb.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccseosmeb.myaoosneb.egniix.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccseosmeb.myaoosneb.eiblhv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccseosmeb.myaoosneb.ejxxpq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccseosmeb.myaoosneb.eonors.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccseosmeb.myaoosneb.erxemo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccseosmeb.myaoosneb.espkgb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccseosmeb.myaoosneb.fgopqn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccseosmeb.myaoosneb.fntxet.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccseosmeb.myaoosneb.focamc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccseosmeb.myaoosneb.fodxlh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccseosmeb.myaoosneb.gqnrcz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccseosmeb.myaoosneb.gsajzb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccseosmeb.myaoosneb.hiqgjp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccseosmeb.myaoosneb.hrzgox.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccseosmeb.myaoosneb.iahbzj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccseosmeb.myaoosneb.ibyljb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccseosmeb.myaoosneb.iicfis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccseosmeb.myaoosneb.jgaooc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccseosmeb.myaoosneb.jpjxxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccseosmeb.myaoosneb.jtaykj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccseosmeb.myaoosneb.lioimy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccseosmeb.myaoosneb.lnkmoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccseosmeb.myaoosneb.manljw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccseosmeb.myaoosneb.mipvrd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccseosmeb.myaoosneb.mltuey.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccseosmeb.myaoosneb.mrnwky.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccseosmeb.myaoosneb.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccseosmeb.myaoosneb.owkcmj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccseosmeb.myaoosneb.piposm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccseosmeb.myaoosneb.rabbhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccseosmeb.myaoosneb.wwbmod.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccseosmeb.myaoosneb.ywmdmi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccseosmeb.myaoosneb.zbomvh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccseosmeb.myaoosneb.zbqfwh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccseosmeb.myaoosneb.zfeixc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccseosmeb.myaoosneb.zipdjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasccseosmeb.myaoosneb.zwldnt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseaascsoeb.1238797.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseaascsoeb.3123978.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseaascsoeb.3548738.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseaascsoeb.3587841.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseaascsoeb.3877845.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseaascsoeb.3987845.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseaascsoeb.6156875.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseaascsoeb.aehkez.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseaascsoeb.bhmnyn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseaascsoeb.bmbrqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseaascsoeb.ckeqkb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseaascsoeb.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseaascsoeb.davgri.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseaascsoeb.djicub.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseaascsoeb.ehzdsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseaascsoeb.fftefq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseaascsoeb.fqaqay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseaascsoeb.fvzlph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseaascsoeb.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseaascsoeb.homhcy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseaascsoeb.hrk93.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseaascsoeb.krxyum.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseaascsoeb.mfwrsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseaascsoeb.mijkvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseaascsoeb.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseaascsoeb.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseaascsoeb.oeeppj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseaascsoeb.olbrdx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseaascsoeb.owhfzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseaascsoeb.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseaascsoeb.qmponh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseaascsoeb.raymtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseaascsoeb.rdoryw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseaascsoeb.rgwvvl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseaascsoeb.rinlvb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseaascsoeb.rtvsct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseaascsoeb.rxqkhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseaascsoeb.ssmkdz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseaascsoeb.sswfzk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseaascsoeb.subkwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseaascsoeb.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseaascsoeb.urolol.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseaascsoeb.vneggf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseaascsoeb.vzfbiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseaascsoeb.wxjoux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseaascsoeb.xfcxny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseaascsoeb.xrrtvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseacsoeb.1397848.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseacsoeb.1978777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseacsoeb.3123978.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseacsoeb.3548738.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseacsoeb.3978844.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseacsoeb.3987845.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseacsoeb.6156875.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseacsoeb.9912447.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseacsoeb.aehkez.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseacsoeb.bhmnyn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseacsoeb.bmbrqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseacsoeb.ckeqkb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseacsoeb.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseacsoeb.davgri.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseacsoeb.djicub.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseacsoeb.ehzdsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseacsoeb.fftefq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseacsoeb.fqaqay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseacsoeb.fvzlph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseacsoeb.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseacsoeb.homhcy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseacsoeb.hrk93.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseacsoeb.krxyum.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseacsoeb.mfwrsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseacsoeb.mijkvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseacsoeb.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseacsoeb.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseacsoeb.oeeppj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseacsoeb.owhfzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseacsoeb.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseacsoeb.qmponh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseacsoeb.raymtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseacsoeb.rdoryw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseacsoeb.rgwvvl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseacsoeb.rinlvb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseacsoeb.rtvsct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseacsoeb.ssmkdz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseacsoeb.sswfzk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseacsoeb.subkwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseacsoeb.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseacsoeb.urolol.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseacsoeb.vneggf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseacsoeb.vzfbiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseacsoeb.wxjoux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseacsoeb.xfcxny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseycceaoojearescoooseacsoeb.xrrtvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescoooseccsocsoeb.1238797.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescoooseccsocsoeb.1397848.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescoooseccsocsoeb.1978777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescoooseccsocsoeb.2397874.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescoooseccsocsoeb.3123978.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescoooseccsocsoeb.3197874.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescoooseccsocsoeb.3997887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescoooseccsocsoeb.9912447.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescoooseccsocsoeb.aehkez.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescoooseccsocsoeb.bhmnyn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescoooseccsocsoeb.bmbrqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescoooseccsocsoeb.ckeqkb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescoooseccsocsoeb.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescoooseccsocsoeb.davgri.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescoooseccsocsoeb.djicub.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescoooseccsocsoeb.ehzdsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescoooseccsocsoeb.fftefq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescoooseccsocsoeb.fqaqay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescoooseccsocsoeb.fvzlph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescoooseccsocsoeb.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescoooseccsocsoeb.homhcy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescoooseccsocsoeb.hrk93.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescoooseccsocsoeb.krxyum.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescoooseccsocsoeb.kthlcb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200008292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescoooseccsocsoeb.mfwrsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescoooseccsocsoeb.mijkvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescoooseccsocsoeb.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescoooseccsocsoeb.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescoooseccsocsoeb.oeeppj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescoooseccsocsoeb.olbrdx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescoooseccsocsoeb.owhfzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescoooseccsocsoeb.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescoooseccsocsoeb.qmponh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescoooseccsocsoeb.raymtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescoooseccsocsoeb.rdoryw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescoooseccsocsoeb.rgwvvl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescoooseccsocsoeb.rinlvb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescoooseccsocsoeb.rtvsct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescoooseccsocsoeb.rxqkhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescoooseccsocsoeb.ssmkdz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescoooseccsocsoeb.sswfzk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescoooseccsocsoeb.subkwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescoooseccsocsoeb.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescoooseccsocsoeb.urolol.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescoooseccsocsoeb.vneggf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescoooseccsocsoeb.vzfbiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescoooseccsocsoeb.wxjoux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescoooseccsocsoeb.xfcxny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescoooseccsocsoeb.xrrtvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescooosecsoeb.1238797.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescooosecsoeb.3123978.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescooosecsoeb.6156875.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescooosecsoeb.9912447.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescooosecsoeb.aehkez.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescooosecsoeb.bhmnyn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescooosecsoeb.bmbrqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescooosecsoeb.ckeqkb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescooosecsoeb.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescooosecsoeb.davgri.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescooosecsoeb.djicub.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescooosecsoeb.ehzdsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescooosecsoeb.fftefq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescooosecsoeb.fqaqay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescooosecsoeb.fvzlph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescooosecsoeb.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescooosecsoeb.homhcy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescooosecsoeb.hrk93.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescooosecsoeb.krxyum.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescooosecsoeb.kthlcb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200008337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescooosecsoeb.mfwrsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescooosecsoeb.mijkvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescooosecsoeb.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescooosecsoeb.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescooosecsoeb.oeeppj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescooosecsoeb.olbrdx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescooosecsoeb.owhfzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescooosecsoeb.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescooosecsoeb.qmozk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescooosecsoeb.qmponh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescooosecsoeb.raymtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescooosecsoeb.rdoryw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescooosecsoeb.rgwvvl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescooosecsoeb.rinlvb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescooosecsoeb.rtvsct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescooosecsoeb.rxqkhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescooosecsoeb.ssmkdz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescooosecsoeb.sswfzk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescooosecsoeb.subkwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescooosecsoeb.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescooosecsoeb.urolol.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescooosecsoeb.vneggf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescooosecsoeb.vzfbiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescooosecsoeb.wxjoux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescooosecsoeb.xfcxny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaaaosearescooosecsoeb.xrrtvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseccsooeb.1978777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseccsooeb.2397874.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseccsooeb.3215479.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseccsooeb.3299978.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseccsooeb.3548738.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseccsooeb.9912447.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseccsooeb.aehkez.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseccsooeb.bhmnyn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseccsooeb.bmbrqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseccsooeb.ckeqkb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseccsooeb.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseccsooeb.davgri.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseccsooeb.djicub.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseccsooeb.ehzdsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseccsooeb.fftefq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseccsooeb.fqaqay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseccsooeb.fvzlph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseccsooeb.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseccsooeb.homhcy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseccsooeb.krxyum.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseccsooeb.mfwrsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseccsooeb.mijkvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseccsooeb.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseccsooeb.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseccsooeb.oeeppj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseccsooeb.olbrdx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseccsooeb.owhfzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseccsooeb.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseccsooeb.qmponh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseccsooeb.raymtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseccsooeb.rdoryw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseccsooeb.rgwvvl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseccsooeb.rinlvb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseccsooeb.rtvsct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseccsooeb.rxqkhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseccsooeb.ssmkdz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseccsooeb.sswfzk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseccsooeb.subkwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseccsooeb.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseccsooeb.urolol.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseccsooeb.vneggf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseccsooeb.vzfbiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseccsooeb.wxjoux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseccsooeb.xfcxny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseccsooeb.xrrtvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseoeb.1238797.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseoeb.1397848.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseoeb.2397874.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseoeb.3197874.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseoeb.3215479.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseoeb.3299978.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseoeb.3978458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseoeb.3978487.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseoeb.aehkez.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseoeb.bhmnyn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseoeb.bmbrqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseoeb.ckeqkb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseoeb.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseoeb.davgri.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseoeb.djicub.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseoeb.ehzdsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseoeb.fftefq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseoeb.fqaqay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseoeb.fvzlph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseoeb.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseoeb.homhcy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseoeb.krxyum.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myceojascoseaascsoeb.1444588.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myceojascoseaascsoeb.3354788.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myceojascoseaascsoeb.bcjgin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myceojascoseaascsoeb.bjdsqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myceojascoseaascsoeb.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myceojascoseaascsoeb.drqelj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myceojascoseaascsoeb.duppjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myceojascoseaascsoeb.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myceojascoseaascsoeb.kihmid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myceojascoseaascsoeb.mrogod.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myceojascoseaascsoeb.mwojiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myceojascoseaascsoeb.nlcrmz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myceojascoseaascsoeb.sfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200008443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myceojascoseaascsoeb.sfts.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200008444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myceojascoseaascsoeb.ssminn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myceojascoseaascsoeb.tdvpct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myceojascoseaascsoeb.tilgij.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myceojascoseaascsoeb.xeoadw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myceojascoseaascsoeb.xmlqpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myceojascoseaascsoeb.yalpuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myceojascoseaascsoeb.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myceojascoseaascsoeb.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myceojascoseaascsoeb.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myceojascoseacsoeb.3354788.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myceojascoseacsoeb.chaincomp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myceojascoseacsoeb.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myceojascoseacsoeb.eesnax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myceojascoseacsoeb.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myceojascoseacsoeb.gvtkxq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myceojascoseacsoeb.hzzpvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myceojascoseacsoeb.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myceojascoseacsoeb.jaftcq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myceojascoseacsoeb.kvivli.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myceojascoseacsoeb.msqkez.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myceojascoseacsoeb.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myceojascoseacsoeb.nthuga.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myceojascoseacsoeb.pajngn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myceojascoseacsoeb.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myceojascoseacsoeb.ssminn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myceojascoseacsoeb.tjkoas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myceojascoseacsoeb.ugelbf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myceojascoseacsoeb.uhijmv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myceojascoseacsoeb.vgedvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myceojascoseacsoeb.wfmcjb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myceojascoseacsoeb.xchztf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myceojascoseacsoeb.xmlqpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myceojascoseacsoeb.yczpuk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myceojascoseacsoeb.yxpfzh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascoseccsocsoeb.1444588.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascoseccsocsoeb.a80117.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200008480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascoseccsocsoeb.chaincomp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascoseccsocsoeb.coinwallet.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascoseccsocsoeb.duppjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascoseccsocsoeb.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascoseccsocsoeb.ewdbda.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascoseccsocsoeb.fmttqq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascoseccsocsoeb.hzwrnd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascoseccsocsoeb.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascoseccsocsoeb.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascoseccsocsoeb.mwojiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascoseccsocsoeb.ojfyvi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascoseccsocsoeb.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascoseccsocsoeb.rhurgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascoseccsocsoeb.sbelxi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascoseccsocsoeb.tdvpct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascoseccsocsoeb.tilgij.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascoseccsocsoeb.tjkoas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascoseccsocsoeb.ucluzr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascoseccsocsoeb.uhijmv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascoseccsocsoeb.umjnpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascoseccsocsoeb.xchztf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascoseccsocsoeb.xmlqpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascoseccsocsoeb.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascoseccsocsoeb.yczpuk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascoseccsocsoeb.yezuns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascoseccsocsoeb.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascoseccsocsoeb.yxpfzh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascosecsoeb.1157777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascosecsoeb.1444588.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascosecsoeb.2124458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascosecsoeb.asxrvb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascosecsoeb.bcjgin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascosecsoeb.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascosecsoeb.coinwallet.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascosecsoeb.dsyqit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascosecsoeb.hzwrnd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascosecsoeb.hzzpvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascosecsoeb.jcqpfm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascosecsoeb.kihmid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascosecsoeb.kobagq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascosecsoeb.kvivli.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascosecsoeb.msqkez.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascosecsoeb.mwojiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascosecsoeb.nlcrmz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascosecsoeb.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascosecsoeb.sdutxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascosecsoeb.sfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200008527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascosecsoeb.sfts.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200008528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascosecsoeb.ssminn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascosecsoeb.tohjkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascosecsoeb.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascosecsoeb.uhijmv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascosecsoeb.vyihmf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascosecsoeb.xeoadw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascosecsoeb.yczpuk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjaasascosecsoeb.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjacsascoseccsooeb.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjacsascoseccsooeb.2124458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjacsascoseccsooeb.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjacsascoseccsooeb.cemlfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjacsascoseccsooeb.coinwallet.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjacsascoseccsooeb.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjacsascoseccsooeb.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjacsascoseccsooeb.gvtkxq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjacsascoseccsooeb.gwrlwh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjacsascoseccsooeb.jaftcq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjacsascoseccsooeb.msqkez.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjacsascoseccsooeb.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjacsascoseccsooeb.owbxts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjacsascoseccsooeb.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjacsascoseccsooeb.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjacsascoseccsooeb.sbelxi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjacsascoseccsooeb.tohjkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjacsascoseccsooeb.vfelco.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjacsascoseccsooeb.vgedvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjacsascoseccsooeb.vjkyoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjacsascoseccsooeb.vjzvtr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjacsascoseccsooeb.vyihmf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjacsascoseccsooeb.xchztf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjacsascoseccsooeb.xeoadw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjacsascoseccsooeb.xjdpgi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjacsascoseccsooeb.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjacsascoseccsooeb.yagtso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjacsascoseccsooeb.yalpuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjacsascoseccsooeb.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjacsascoseccsooeb.yxpfzh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjacsascoseccsooeb.zhhqjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjacsascoseoeb.1444588.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjacsascoseoeb.bjdsqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjacsascoseoeb.cartil.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjacsascoseoeb.cipgmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjacsascoseoeb.dwrnsk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjacsascoseoeb.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjacsascoseoeb.fuufvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjacsascoseoeb.jaftcq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjacsascoseoeb.kobagq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjacsascoseoeb.kvivli.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjacsascoseoeb.msqkez.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjacsascoseoeb.mvigpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjacsascoseoeb.ojfyvi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjacsascoseoeb.sfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200008581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjacsascoseoeb.uobmas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjacsascoseoeb.vfelco.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjacsascoseoeb.yagtso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjacsascoseoeb.yczpuk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjacsascoseoeb.yezuns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjacsascoseoeb.yxpfzh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoccaseseb.myjacsascoseoeb.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojaascsoeb.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojaascsoeb.fmrxl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojaascsoeb.gpsjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojaascsoeb.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojaascsoeb.hdjtd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojaascsoeb.ipnnct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojaascsoeb.iwggbt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojaascsoeb.izokl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojaascsoeb.jayocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojaascsoeb.jqwgwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojaascsoeb.kbjbz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojaascsoeb.lheqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojaascsoeb.lsaaas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojaascsoeb.lslois.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojaascsoeb.lslxisoa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojaascsoeb.mhftfp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojaascsoeb.npibd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojaascsoeb.ohvcp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojaascsoeb.ojpih.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojaascsoeb.pfbueg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojaascsoeb.plcxj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojaascsoeb.qglno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojaascsoeb.qqwhps.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojaascsoeb.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojaascsoeb.rbfmfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojaascsoeb.sfts.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200008614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojaascsoeb.sfts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojaascsoeb.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojaascsoeb.uynfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojaascsoeb.velxb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojaascsoeb.vnbxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojaascsoeb.vppvl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojaascsoeb.xopup.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojaascsoeb.ylbde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojaascsoeb.ymgar.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojaascsoeb.ypzcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.0633348.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.1223478.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.15537777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.2354387.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.2355587.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.3333347.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.3456588.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.3533357.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.3545331.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.3888347.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.4478687.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.4488877.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.4566368.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.4566878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.4678865.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.4687999.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.5378887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.5387814.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.6123878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.6366778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.6788777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.6788877.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.6887453.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.6975877.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.6979885.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.7688477.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.7788513.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.9556788.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.9978777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.9997854.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.9997875.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.ahiatgp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.ahibtgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.ahictgl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.ahidtgf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.ahigtgg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.ahihtgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.avmueo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.biyzde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.bozoob.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.cderfv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.fmrxl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.gpsjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.hdjtd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.ipnnct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.iwggbt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.izokl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.jayocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.jqwgwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.kbjbz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.lheqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.lsksodi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.lslois.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.mengdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.mhftfp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.npibd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.ohvcp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.ojpih.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.pfbueg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.plcxj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.qglno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.qqwhps.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.sfts.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200008696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.sfts.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200008697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.sfts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.uynfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.velxb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.vppvl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.xopup.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.ylbde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.ymgar.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myceojacsoeb.ypzcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.0633348.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.1223478.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.15537777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.2354387.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.2355587.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.3333347.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.3456588.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.3533357.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.3545331.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.3556678.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.3888347.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.4478687.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.4488877.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.4566368.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.4566878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.4678865.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.4687999.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.5378887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.5387814.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.6123878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.6366778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.6788777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.6788877.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.6887453.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.6975877.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.6979885.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.7688477.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.7788513.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.9556788.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.9978777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.9997854.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.9997875.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.ahiatgp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.ahibtgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.ahictgl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.ahidtgf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.ahigtgg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.ahihtgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.avmueo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.biyzde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.bozoob.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.fmrxl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.gpsjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.hdjtd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.ipnnct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.iwggbt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.izokl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.jayocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.jqwgwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.kbjbz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.lheqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.lslois.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.mhftfp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.npibd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.ohvcp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.ojpih.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.pfbueg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.plcxj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.qglno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.qqwhps.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.rbfmfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.sfts.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200008777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.sfts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.uynfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.velxb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.vnbxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.vppvl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.xopup.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.ylbde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.ymgar.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaasccsocsoeb.ypzcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaascsoeb.0633348.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaascsoeb.1223478.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaascsoeb.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaascsoeb.15537777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaascsoeb.2354387.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaascsoeb.2355587.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaascsoeb.3333347.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaascsoeb.3456588.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaascsoeb.3533357.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjaascsoeb.3545331.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.0633348.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.1223478.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.15537777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.2354387.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.2355587.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.3333347.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.3456588.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.3533357.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.3545331.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.3556678.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.3888347.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.4478687.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.4488877.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.4566368.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.4566878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.4678865.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.4687999.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.5378887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.5387814.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.6123878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.6366778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.6788777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.6788877.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.6887453.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.6975877.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.6979885.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.7688477.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.7788513.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.9556788.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.9978777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.9997854.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.9997875.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.ahiatgp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.ahibtgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.ahictgl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.ahidtgf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.ahigtgg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.ahihtgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.avmueo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.biyzde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.bozoob.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.cderfv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.fmrxl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.gpsjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.hdjtd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.ipnnct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.iwggbt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.izokl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.jayocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.jqwgwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.kbjbz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.lheqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.lsaaas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.lslxisoa.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.mhftfp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.npibd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.ohvcp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.ojpih.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.pfbueg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.plcxj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.qglno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.qqwhps.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.rbfmfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.sfts.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200008870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.sfts.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200008871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.sfts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.uynfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.velxb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.vnbxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.vppvl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.xopup.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.ylbde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.ymgar.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascoseb.myjacsccsooeb.ypzcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascseooeb.myejaoseeseb.vxttxa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascsosceob.aaeasneoscb.tsqcxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascsosceob.aaeasneoscb.vaylqb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjascsosceob.aaeasneoscb.wdzxnt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasosceob.aasneoscb.rhxhhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasosceob.aasneoscb.rxiarn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasosceob.aasneoscb.twjzsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasosceob.aasneoscb.uviayc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasscsoscesb.mesaicsceoosb.rqvoml.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasscsoscesb.mesaicsceoosb.toajeg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasscsoscesb.mesaicsceoosb.wizpri.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasvsescsoscesb.mesaccaseicsceoosb.vwczmd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjasvsescsoscesb.mesaccaseicsceoosb.wnmoss.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcb.cord.jp.5713kxpk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcoeeocsb.omyjaceb.axxgwf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcoeeocsb.omyjaceb.clfuxn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcoeeocsb.omyjaceb.cqbgcx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcoeeocsb.omyjaceb.dferdn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcoeeocsb.omyjaceb.duogfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcoeeocsb.omyjaceb.etsffm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcoeeocsb.omyjaceb.flvxkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcoeeocsb.omyjaceb.gpghar.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcoeesoscbo.mcyjaceb.cpssxk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcoeesoscbo.mcyjaceb.duogfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcoeesoscbo.mcyjaceb.fpmrgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcoeesoscbo.mcyjaceb.gimhld.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcoeesoscbo.mcyjaceb.gpghar.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcoeesoscbo.mcyjaceb.hlztae.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcoeesoscbo.mcyjaceb.hndvyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcoeesoscbo.mcyjaceb.iscgtq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcoeocb.myjaceb.axxgwf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcoeocb.myjaceb.elvlic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcoeocb.myjaceb.ibrpat.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcoeocb.myjaceb.imyrhj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcoesocb.mcyjaceb.hlmecj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myjcoesocb.mcyjaceb.jxajmg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mymweb-owner.at.ua"; content:"Host"; http_header; classtype:attempted-recon; sid:200008918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mynzsjh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200008919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mypayslip.sutherlandglobal.cm"; content:"Host"; http_header; classtype:attempted-recon; sid:200008920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"myshedbuilder.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mystandtrustonline.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mysticalmasks.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mytax-iras.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mytheamsauthecent.wapgem.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"mytoshop.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"n0r.vashonlove.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"n7sbo-qaaaa-aaaad-qddja-cai.raw.ic0.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"na.mims.cheeseconnoisseur.ca"; content:"Host"; http_header; classtype:attempted-recon; sid:200008929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nab-alert.mobi"; content:"Host"; http_header; classtype:attempted-recon; sid:200008930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nab-www.303.si"; content:"Host"; http_header; classtype:attempted-recon; sid:200008931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nadare.com.ar"; content:"Host"; http_header; classtype:attempted-recon; sid:200008932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"najboljeuslugezavas.betterservicesforyou.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nam.vashonlove.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"namele.marpuasabentar.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"namelessajaa.topijerami.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"namelesstr.topijerami.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200008937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nano.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nanouchimusic.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"napffx5.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"narabeautyusa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nascimentoadvg.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nasdaqet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"natalsafety.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200008944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nattynetworks.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"naturhouse.sk"; content:"Host"; http_header; classtype:attempted-recon; sid:200008946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"navi-drops.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200008947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"navi00.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"navi11.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"navi33.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"navi44.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"navi57.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"navi66.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"navi9.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"navivincere.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200008955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nayanielectronics.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nbfcds.h0xss0y.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200008957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ncop.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200008958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ncvds.azkvyog.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200008959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ndeflawtechnologies.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"necessitymag.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"necudneflirty.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nedbankqa.flowblocks.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"neilos43.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"neivaecosta.adv.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200008965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nerestera.onrender.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nervous-goldwasser.23-102-113-20.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200008967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"netfiix.client-abonnement.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200008968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"netflix-tv.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200008969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"netflixguiltless-guide.surge.sh"; content:"Host"; http_header; classtype:attempted-recon; sid:200008970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"netflixvalidz.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200008971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"netp001.temp.swtest.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200008972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"networkdebug.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200008973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"networksolutions-fd.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"networksolutions-fd.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200008975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"neurovestibularconsults.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"neurovestibularrehabconsultants.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"neversencommun.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200008978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"newhopemakassar.co.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200008979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"newmont.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"news.boundlesstrucks.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"newtondancecompany.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"newty.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200008983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"newvvtons-b598e7.ingress-erytho.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200008984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nex5l-kyaaa-aaaad-qddlq-cai.ic.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200008985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nfcunavyc2.temp.swtest.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200008986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nft-50.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nftio.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200008988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nftracking.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200008989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nfts-pro.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200008990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nfwyx3.blvvb.tech625.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ng13ucqfogrua4ntapt0fjhqg4c5qt3vtnkvuf0766u1dfn8qktjfqo.siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200008992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ng4a6ida.dreamwp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ngfvds.bsjpfdb.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200008994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ngsmartrp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nhattinsteel.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200008996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nhbfd.sbeawef.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200008997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nhk-cstv-japan.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200008998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nhk-cstv-japan.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200008999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nhk-tv-japan.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nhk-tv-japan.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nhk-tvs-japan.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nhk.plus.ozoev.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200009003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nhsapply-covid-pass.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nhsfdhyubzsxyu.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200009005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nhzyhmygjg.temp.swtest.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200009006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"niagarapower.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nibagroup.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200009008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nicoleaction.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nicoledruschnewitz.clickfunnels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nieuwpoortbe.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nikkibeautysalon.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nikkofarmer.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nitro.neeve.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200009014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nivel.co.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200009015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nizotchauffage.bilty.be"; content:"Host"; http_header; classtype:attempted-recon; sid:200009016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"njfgd.m439w8a.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200009017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nl-sessie-f3ma3n.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nl-sessie-u4a0yh.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nl-sessie-v8v02m.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nl-sessie-v8v02m.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nlog.leshazlewood.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nlrxh5.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nmrefrigeration.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nodemoh-31651.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nodemoh-31651.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nodesauths.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"noisy-cake-47d3.nh29901021139.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"noisy-moon-0609.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200009029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"noisy-wildflower-6765.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200009030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nominatedfiles.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"none-of-his-present.my.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200009032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nonprofitnetworkofindia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nordiadata.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"normalangstonrealestate.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"northeastmutual.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nosposte458d.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nossas-solucoes-agora.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"note3postalweb.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"note3postalweb.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"notebookr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"notife.help.institutepages.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"notification-fb.secure-pages.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"notify-me.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200009044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nour-ala-nour.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nourayatravel.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"novaktech.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200009047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"np.bb0n.cheeseconnoisseur.ca"; content:"Host"; http_header; classtype:attempted-recon; sid:200009048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nplusjdelights.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nroedreamcare.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ns2ytdhdyu.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ns2ytdhdyu.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nsphd.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200009053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nspi.in.th"; content:"Host"; http_header; classtype:attempted-recon; sid:200009054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nt.embluemail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nucleoresultado.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nuevo-tuya-2.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200009057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nuevoo365tuya.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200009058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nuevoo365tuyya14.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200009059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nuu.vashonlove.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nvidia1651665403.zendesk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nwss419.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nxl58s.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nyestriasztas.hu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nyiksaulekel.66ghz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nymo.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200009066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nyooozcms.lexiconcpl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nysestarts.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"nysethkpd.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"o-lane.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"o-macu-confirmationaspx.dray-dns.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200009071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oasisworkz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oasysfactory.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"objectstorage.uk-cardiff-1.oraclecloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"observinglife.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200009075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ochsnermail.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ocioturismogalicia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ocnewyork.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200009078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"octoberedu.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"odd-field-9e1d.microsft-docs-foecisayant.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"odd-lake-a237.hvac.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oferta-smarttv-magazineluiza.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ofertasdomescb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"offcoursse-001-site1.itempurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"offic4280692.sitebuilder.name.tools"; content:"Host"; http_header; classtype:attempted-recon; sid:200009085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officalmial.directorycomms.cyou"; content:"Host"; http_header; classtype:attempted-recon; sid:200009086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office-filedesk.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office-invauth13425.zeknotarzo.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office.ways-status.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office11-1ec19.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office2d8c859610bcdfda2aff8ab4ee713f324334859610bcdfda2aff8ab4e.mumail1m.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office36400450049.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office36400450049.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office365-owa1657.microsoftteams.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office365-owa6878.microsoftpublisher.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office365-securedocs-onmic000000.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office365emailverification9.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office365fileshare.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office365projectmemo.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office365secureddocumentfromexitrealty.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office365xxxjhgxxxonedrivekjhjdggccx.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office39283c79b6d239c952b821624b0e6a26c3383c79b6d239c952b821624.emailnow2.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office47b2d40e22835685e44e94164b369b0947b2d40e22835685e44e94164.microsoftmail.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office5365.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office59ff28a9ed775a7d46a28beba6fce0f59ff28a9ed775a7d46a28beba6.microsoftmail1.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office7be5d0cc7597185ea2b07c5d67ace2647be5d0cc7597185ea2b07c5d6.mailmicrosoft.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office80f8a649b49eef411c04a82b3e39b85b80f8a649b49eef411c04aa8fd.onedriveoffice.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office8c2efa1ee4e8c21d31ba7e06f22188657d48c21d31ba7e06f22188657.microsoftmailx.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office92860fc8359aa442dbbbd31cd358386492860fc8359aa442dbbbd31cd.microsoftdrives1.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office9394943994.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office9394943994.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office949abb2585772ab51a8ad332f13989dcd5d5bb2585772ab51a8ad332f.abcsenderz.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"office949abb2585772ab51a8ad332f13989dcd5d5bb2585772ab51a8ad332f.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200009113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officea71129dd3bfe53d70402d117d90b6b9ba71129dd3bfe53d70402d117d.softdrivez.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officedrive204b23499ee682480a9d4fb5592dcf30c7b323499ee682480a9d.ondreivsds.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officedrive671d943c66d43639ff504f6e8603b0d3637b943c66d43639ff50.offices365files.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officedrive6860908c937775e0f58fe179754804126860908c937775e0f58f.onedrivesgf.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officedrivef7848b1089c0b94ba05f0ee7a32b53dbf7848b1089c0b94ba05f.drivecheckmails.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officedrivesxe85bdf3fb68145124c57c78d1f798930e85bdf3fb68145124c.sureonedrive.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officeee.bubbleapps.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200009120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officelinelinks.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officematsolutions.co.za"; content:"Host"; http_header; classtype:attempted-recon; sid:200009122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officemicrosoft4cc17ac0369d77b37b0126363c5a814f4cc17ac0369d77b3.sharepointsoft.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officeonedrive0449c492c4fd1eb2f9a68932d4b8e7ff0449c492c4fd1eb2f.mcrosoftfilez6879.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officeonedrive23b246dc1dc8470a919f50b6dd839dfb23b246dc1dc8470a9.offcedrives.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officeonedrive25ffed98fda6dd6c8d5c80834463490d25ffed98fda6dd6c8.microsoftz.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officeonedrive634e3a53e73e0036f30a04bf224dcf85634e3a53e73e0036f.microsoft1.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officeonedrive9cf9dd481ca05e2e7a7837abcf593ef6e37abcf593ef6e37a.mcrosoftfiles.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officeonedrivea3188350d116c56f4640139145cbca08a3188350d116c56f4.officepos.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officeonedriveaf5f5e5ad0794773bb4296155c18d99caf5f5e5ad0794773b.softofficex.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officeonedrivec34109e8baa4f981ff836aec31d86510c34109e8baa4f981f.softshare.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officeonedrives2e38ea393a11eb94bd1bc533816b19052e38ea3b19052e38.filemicrosoft1.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officeonline.manifo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officeoutlookfdaa672a942961604a8cd3b0cb5247c2fdaa672a942961604a.abcsender.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"offices7b6ce136c0aad19d8d3ef2d19e7d8b515989e136c0aad19d8d3ef2d1.officesgm.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officesecurity.skykoya.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officialliker.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200009137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officialraydium.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"officialsolanalooks.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"offyourplate.my.idaptive.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ofor.d3k78mj8lh5nlv.amplifyapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ohfi-innovationdepartment.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ohnorug.co.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200009143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ohw.tf"; content:"Host"; http_header; classtype:attempted-recon; sid:200009144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oidc.idp.elogin.access.us.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oidc.idp.elogin.e-access.sso.us.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oixgiejo8596.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"okay-app-99-html.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"okay-app-99-html.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"okay99-neueupdate-15849657.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"okci.vip"; content:"Host"; http_header; classtype:attempted-recon; sid:200009151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"okcphotoboothrental.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"okdlxjg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"okesipmantaaap9817766627verifyaccount.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oknaksdrun.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"okrn.vip"; content:"Host"; http_header; classtype:attempted-recon; sid:200009156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"okus.vip"; content:"Host"; http_header; classtype:attempted-recon; sid:200009157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"okzs.vip"; content:"Host"; http_header; classtype:attempted-recon; sid:200009158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olabert.playcode.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200009159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"old-file-surf-978b.theattdrops6111.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"old.martobang.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oldconfezfzfrenc.leaseholdconference.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200009162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olivepresentstaff.coljbveiur.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200009163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oliviwq.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oljaklve14.vip"; content:"Host"; http_header; classtype:attempted-recon; sid:200009165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oluwarantinmialafia.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pl-xhp.accept8145.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200009167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"olx-pol-kxlsw2.pl-id934213.beauty"; content:"Host"; http_header; classtype:attempted-recon; sid:200009168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"omareturnian.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"omentiandh4.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"omentiandh5.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"omentiandh6.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"omniafricashop.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200009173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onedrive-shared.zineadiet.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onedrive.dpot.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onedrive.jennitai.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onedrive.lqbby.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onedrivee5.joejoe5.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onedriveoffice28432c5b1f27614986e6d114fb3cb70028432c5b1f2761498.checkonedrives.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onee-a0488.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oneone-19cd8.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onescanner.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onli7ne-chase4xweb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"online-omgebung.de.upgradepage.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200009184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"online-pdf-portal.visura.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200009185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"online-us-postal-service-support.builderallwppro.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"online.attservice.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"online.validationsynonyms.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlinebncoitau.x10.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200009189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlinebncopyitau.x10.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200009190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlinehistory1111117777ig.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlineoffice365-owa5418.microsoftcertifications2022.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlinesecure.ankarasessistemi.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"only-log.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200009194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"onlysportplus.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ooo4-67e89.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ooo4-67e89.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"opdateringsrvc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"opemcea.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200009199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"open-sea-a4fef.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"openconnseanft.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200009201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"opensea-help.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"opensea-jo.tech"; content:"Host"; http_header; classtype:attempted-recon; sid:200009203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"opensea-lo.tech"; content:"Host"; http_header; classtype:attempted-recon; sid:200009204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"opensea-lottery.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"opensea-nf.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"opensea-support.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200009207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"opensea-tools.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200009208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"openseaapikey.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"openseaspps.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"openseavalidation.tech"; content:"Host"; http_header; classtype:attempted-recon; sid:200009211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"opensee-marketplace.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"openseea-io-nft.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"optimihealthwd.mschlsmn.one"; content:"Host"; http_header; classtype:attempted-recon; sid:200009214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"optus-support.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200009215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"optydistribution.ca"; content:"Host"; http_header; classtype:attempted-recon; sid:200009216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"opulentspectrum.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orabote.name"; content:"Host"; http_header; classtype:attempted-recon; sid:200009218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orange-darkness-4210.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200009219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orange-messegeriasfr.gq"; content:"Host"; http_header; classtype:attempted-recon; sid:200009220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orange-security.cloud.coreoz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orange.iobeya.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orange.sphinxonline.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200009223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orange.windagrande78.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orangebank.mailerpage.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200009225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orangee-baank.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orangemessagerieactis.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oranges-team.adalo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orangess.contactin.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200009229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orcube-bf0cf.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ordernew11010101.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200009231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ordernew312311.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200009232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ordernew3124123.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200009233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"originmirrors.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ormantencs112.odoo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ornima.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"orusengenharia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ospasjx2.gq"; content:"Host"; http_header; classtype:attempted-recon; sid:200009238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ospxighh.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"otomoto-h229.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200009240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"otomoto3452.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ou1ook-maile-1d28.queri.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ourketopantry.co.nz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ourketopantry.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"outlok.formaloo.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200009245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"outlook-terms670.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"outlook11-fe307.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"outlook1541489.webcindario.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"outlookadminsupport.softr.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"outlookonline.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"outlookowa.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"outlookowalive.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ouygh.wepwyxf.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200009253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ouyids.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200009254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ouyids.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200009255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ouyids.net.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200009256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ouyisa.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200009257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ouyisa.com.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200009258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ouyisf.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200009259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ov-h-709f2.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ov-h-709f2.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ovh-cl0ud.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ovh-dfh.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ovh-link.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ovh-link.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ovhh-0.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ovhh-19f4a.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ovhvh-9f8e4.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"owaoutlookwebappde.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"owaweb3-6-5.mailauthorize.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"owoo7569.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oxbtki.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oyoshopbuisness.easy.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200009273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"oyqnjgl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ozboya.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ozo.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"p0llyg0n-org.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200009277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"p0lygon-php.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"p2pfrontend2-64a205.ingress-baronn.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200009279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"p3333xssreviewwees17978458526437s.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"p336eesssc0mfirmflivepage22gastreosld.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"p44g3sauthorserviceloginpages.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"p466355.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"p48es.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"p4g33s.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"package2021.blogspot.ba"; content:"Host"; http_header; classtype:attempted-recon; sid:200009286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"package2021.blogspot.bg"; content:"Host"; http_header; classtype:attempted-recon; sid:200009287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"package2021.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paczka-dpd.order-dostawa42379.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"page-recovery-identity2022.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"page.appmobilepages.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"page27-schnell.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pageessreviewwees17978458526437.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pageidentity2022.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pagerecoveryidentity2.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pages-marvelous-project.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200009296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pages-protetions-updates2022.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200009297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pages-service-center.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200009298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pages.secure-accts.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pagesssecurtysidentitys.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pagosfreetuya.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200009301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pagosportalsegur.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200009302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paiementboncoin.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paiementleboncoin3.wordservice.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200009304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paketinfo.myscriptcase.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"panc.akeswap.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancaekeswap.cloud"; content:"Host"; http_header; classtype:attempted-recon; sid:200009307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancake-super.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancake-swapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancake7wop.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakefinanceswap.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakemobile.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakesvap.finance"; content:"Host"; http_header; classtype:attempted-recon; sid:200009313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakesvvap.financial"; content:"Host"; http_header; classtype:attempted-recon; sid:200009314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakeswa-p.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakeswap-live.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200009316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakeswap.belgianwaffle.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200009317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakeswap.diamondhandsnetwork.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakeswap.finance.tradechange.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200009319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakeswap.himotechglobal.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakeswap.men"; content:"Host"; http_header; classtype:attempted-recon; sid:200009321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakeswap.migrate.finance"; content:"Host"; http_header; classtype:attempted-recon; sid:200009322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakeswapapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakeswapdesign.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakeswaplp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakeswapmeta.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakeswapmeta.win"; content:"Host"; http_header; classtype:attempted-recon; sid:200009327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakeswappshop.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakeswapsupport.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200009329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakeswapz.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancakesweb.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200009331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancalteswap.finance"; content:"Host"; http_header; classtype:attempted-recon; sid:200009332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pancokeswope.finance.mechadda.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"panel-civil.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200009334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"panelas-luizabr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"panelweb-4cae2.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"panpaus.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paragua.x10.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200009338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"parahuyhomepy.x10.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200009339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"parajuniorline22.x10.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200009340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"parallelmetaspace.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"parceiro-magazineluiza.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"parcel.status-65.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"parfumieftin.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"park.great-site.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200009345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"parrucchierando.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"passionfruit4576261.brizy.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200009347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"passwordexpirynotice.mittimunafa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pateltutorials.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pathospitals.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"patient-cell-40f5.updatedlogmylogin.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"patient-cloud-9191.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200009352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paxful.com.ph"; content:"Host"; http_header; classtype:attempted-recon; sid:200009353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paxful53.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paxonlinerates.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200009355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pay-paynet.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200009356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pay2bd.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"payment-failure.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"payment-remittance-advice.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paymentfailed.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paymentnotificationnow.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paymydoctor.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200009362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"paypal.com.0.security-confirmation.d72b69c8e37aec662e13e39d929d6e3d.as2.2u.se"; content:"Host"; http_header; classtype:attempted-recon; sid:200009363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pcsystemscelaya.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdf-cloud-document.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdf-online-view-b9787.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdf-online-view-b9787.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdf-shared-cloud.project-deec.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdf-sharefile-doc.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdf.file-documents.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pdfsecured.mystrikingly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pederopeder.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pembatalan-pemblokiiran2022.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"peoplenettv.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"peppiandco.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200009375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"perfectenergy.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200009376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"perfectliker.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200009377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"perfectunionapparel.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"performancelocal.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"peringatan-pemblokiran-id23.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"peringatan-pemblokiran532.webnode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"peringatanakunfb2k214.webnode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"peringatanpemblokiran273.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"perituza.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"personalcapial.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"personascrfienlinea.pana.red"; content:"Host"; http_header; classtype:attempted-recon; sid:200009386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"personasportal.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200009387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"petopets.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pfghv.asti2b7.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200009389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pfghv.djjxreo.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200009390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pfjykejodq.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pfjykejodq.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pg056rhfcmnmg8vdcvafi64lbeog3qlsml2pr77k9e1tbmm7ft5sv20.siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200009393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pg09lef8vp45t22pv8da9tgpec6btcs8ca5f3tvo3a17frdpfvk0t2g.siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200009394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"phamtomapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"phantom-detect.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"phantom-error.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"phantom-labs-security.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"phantom-notification.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"phantom-walleet.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200009400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"phantom-wallett.azurewebsites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200009401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"phantomwalett.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"phantomwebwallets.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pheromoneattraction.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200009404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"photoboothrentalmemphistn.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"photostock.uns.ac.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200009406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"phreshphoto.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pia-i-rof.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"picnic.industries"; content:"Host"; http_header; classtype:attempted-recon; sid:200009409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pid-aaenoeabbj1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pid-anioaamnnnl.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"piechnik.ca"; content:"Host"; http_header; classtype:attempted-recon; sid:200009412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pikay13.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200009413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pilatesonline.ie"; content:"Host"; http_header; classtype:attempted-recon; sid:200009414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pinballfinder.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pinellascountypropertymanagers.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pinkmaids.sg"; content:"Host"; http_header; classtype:attempted-recon; sid:200009417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pisosfarias-0-polygonon-0.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pitzer-photography.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"piumn.uijrclu.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200009420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pizdavamuebani.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pizzabacau.ro"; content:"Host"; http_header; classtype:attempted-recon; sid:200009422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"placeboook.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plain-meadow-6763.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200009424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plain.selalusalome.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plankin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plasticaindia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"platdujour.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200009428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"play-deikifngsdoms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"play-pegaxy.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200009430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"playersauction.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200009431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"playgalagame.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"playgirlgold.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plg-polygon-tecnology.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"plugtools.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pnipoeqniti1o5ku.qwo231sdx.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200009436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pnjone.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poc-rewards-program-c2dfc.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pococoin-access.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200009439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poconoshotels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poczta-polska.e-kei.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200009441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poissondeterre.ca"; content:"Host"; http_header; classtype:attempted-recon; sid:200009442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poiug.yewtwlb.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200009443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pokajca.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polibrinq.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200009445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poligrafiapias.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poliioonnji-b5f000.ingress-baronn.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200009447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polished-poetry-05d5.crestport.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polishedvcxvb.topijerami.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"political-prisoner.my.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200009450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polkabridge-giveaway.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pollyggon.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pollygonnwalletconect.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poloskairto.hu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polska-vinted-hjso21.dostawa-order475832.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polygon---technology.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polygon-onlline.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polygon-wallet0.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polygonconnecttwallet.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polygonexs05.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polygonixls-leandra.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polygonjan.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polygonmac.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polygonwallet.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polygonxls-raylson.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polygonxlss-antonio.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"polyqon-technology-connect-wallet.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poocoin-bsc-charts-token-connect.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poocoin-connect-app-tokens.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"porrtalperson.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200009470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portal-bci.x10.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200009471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portal-ee.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200009472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portalappseguro.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200009473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portalclicknegocios.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200009474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portalempsweb.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200009475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portalpayexito.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200009476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portalsremskemitrovice.rs"; content:"Host"; http_header; classtype:attempted-recon; sid:200009477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"portaltuyacupo.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200009478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"posb-carouselling.herokuapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"position-exachange-naps.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"poskals.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200009481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"posminterurugiay.ultimatefreehost.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200009482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"post-at.info-trackings.su"; content:"Host"; http_header; classtype:attempted-recon; sid:200009483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"postalfees-uk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"postaltrasacionalexito.lovestoblog.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"postch9192.cargo.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200009486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"postinfosendungsstatus.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"postmailer.onedrive0001.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"potlajsnda.atwebpages.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"powersafeenergia.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"powiadomienia-allegro.42356.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200009491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ppurl.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200009492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pqkhd3u4gd.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200009493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pqolkjhjk14.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200009494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pra-voce-solucoes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pravaas.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"precisioneyesurgical.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200009497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"preppingconfidence.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prestamojulioperu1.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"preview-document.tortesabun.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prgmd.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200009501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"primeone.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"primex-inter.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prince.ps"; content:"Host"; http_header; classtype:attempted-recon; sid:200009504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"printingon5th.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"privat-kunden-info.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200009506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"private-pdf.iteroageme.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"privatkunden-umstellung.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"priyankasandokar1606.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200009509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pro-app.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pro-nfts.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"procedi-ora2022.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"procobro.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"procservautomatizacion.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prodenerg.cfd"; content:"Host"; http_header; classtype:attempted-recon; sid:200009515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prodenerg.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200009516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prodenerg.lol"; content:"Host"; http_header; classtype:attempted-recon; sid:200009517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prodenerg.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200009518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"profescoin.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"profiimobiliare.ro"; content:"Host"; http_header; classtype:attempted-recon; sid:200009520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project-cloud-folder.mature-voice.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project-list.doceungeyymeu.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project-shared-pdf.shared-securee.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project-sheet-doc.assign-sec.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project16e-ad544.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"project16e-ad544.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"projectfiles.trainercentral.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"projectsofyemen.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prometheus.asia-pancakeswap.dysnix.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"promo.mycorporate-rewards.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200009530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"promoexclusivojulio-pe.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"propair.hu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"propertymanagementclearwaterfl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"proposal-projects.procesrpguvins.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"propostedusq.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prosxsiuser.myfreesites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200009536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"protect-4d56vca.surge.sh"; content:"Host"; http_header; classtype:attempted-recon; sid:200009537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"protected-message2022-1311615844.cos.na-ashburn.myqcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"protection-settings.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200009539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"protezioneonlinempsiena.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prstamomarzo2022.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"prueflowbrooks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"psd2-kunde13928.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200009543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"psd2-kunde2171.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200009544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"psd2-kunde44532.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200009545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"psd2-kunde6671.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200009546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"psd2-kunde923.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200009547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"psd2-kunde95133.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200009548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"psd2-kunde99772.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200009549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"psd2-online.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"psd2-online.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200009551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"psdbacau.ro"; content:"Host"; http_header; classtype:attempted-recon; sid:200009552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"psp-lessen-marian.nl"; content:"Host"; http_header; classtype:attempted-recon; sid:200009553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"psqisoe2.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200009554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ptgnew.ptgnetwork.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ptxx.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200009556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pubblico-digitale-identita-digitalebnl.authorizeddns.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200009557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pubgupdate.my.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200009558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"publish-p43452-e180057.adobeaemcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"publishingcompanyreviews.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pulaubiru.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"purrfectbookkeeping.visionwebdev.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"puzzled-mink.w5.wpsandbox.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200009563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pwibhmalaysia.com.my"; content:"Host"; http_header; classtype:attempted-recon; sid:200009564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"pychain.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200009565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qbocd.csb.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200009566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qermaris291123.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qgdsgzeraqfqdfc.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qhj39hfxqftr.clickfunnels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qilqcez.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200009570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qilrs5ojb6qaunse6mqdifu.qwo231sdx.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200009571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qlms1.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qoi1y2jgfk.store"; content:"Host"; http_header; classtype:attempted-recon; sid:200009573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qomdesign.ir"; content:"Host"; http_header; classtype:attempted-recon; sid:200009574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qp1ctm.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qsh74pekkv5e8.clickfunnels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qss1a.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quarantine-2542022app-1311433986.cos.ap-nanjing.myqcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quarantine-mes2742022-1311564033.cos.na-ashburn.myqcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quarantine26042022mic-1311531473.cos.ap-seoul.myqcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quarantine27042022web-1311564033.cos.ap-nanjing.myqcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quarantine29042022app-1311615844.cos.ap-chengdu.myqcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quickverifyaccountby.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"quizzical-mcnulty.185-194-219-163.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200009584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qweovb24lk.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200009585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qwertyui4560-686b3.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qxprhzi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"qy31248461.kmctartscalicut.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200009588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"r9ogn4.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200009589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ra.kiech.correarealtygroup.cl.#.ahr0chm6ly9iywzrcmvpzjnkzdrwegz0n3hzeg83bxnqedv3axdwamq0zgdmbmxrnxh1advnamezzxdudxrnnghnbs5pcgzzlm5mdhn0b3jhz2uubgluay8jywjvbmlsbgfacmhyaw50zxjuyxrpb25hbc5jb20=3d"; content:"Host"; http_header; classtype:attempted-recon; sid:200009590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rackenfordlabs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200009591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"radhikamd.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200009592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caokarsoasoceoseccsoutsen.12380978.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caokarsoasoceoseccsoutsen.366778.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caokarsoasoceoseccsoutsen.6978458.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caokarsoasoceoseccsoutsen.7786945.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caokarsoasoceoseccsoutsen.7997845.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caokarsoasoceoseccsoutsen.93544117.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caokarsoasoceoseccsoutsen.9784585.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caokarsoasoceoseccsoutsen.adijps.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caokarsoasoceoseccsoutsen.ankdujfkx.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200009601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caokarsoasoceoseccsoutsen.auxfvv.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200009602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caokarsoasoceoseccsoutsen.aymaus.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200009603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caokarsoasoceoseccsoutsen.eaosey.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caokarsoasoceoseccsoutsen.hdivud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caokarsoasoceoseccsoutsen.hdjyfur.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200009606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caokarsoasoceoseccsoutsen.nedpvy.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200009607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caokarsoasoceoseccsoutsen.otfake.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caokarsoasoceoseccsoutsen.wjgomb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caokarsoasoceoseccsoutsen.xfpmrv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caokarsoasoceoseccsoutsen.xybwxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caokarsoasoceoseccsoutsen.xzeejb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caokarsoasoceoseccsoutsen.yangyang44.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200009613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caokarsoasoceoseccsoutsen.ykbzoq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caokarsoasoceoseccsoutsen.ynytah.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caokarsoasoceoseccsoutsen.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caokarsoasoceoseccsoutsen.yqpqaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caokarsoasoceoseccsoutsen.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caokarsoasoceoseutsen.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caokarsoasoceoseutsen.4687957.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caokarsoasoceoseutsen.5633845.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caokarsoasoceoseutsen.7786945.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caokarsoasoceoseutsen.7997845.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caokarsoasoceoseutsen.93544117.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caokarsoasoceoseutsen.9978754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caokarsoasoceoseutsen.blyqdj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caokarsoasoceoseutsen.hgzklt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caokarsoasoceoseutsen.ilblz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caokarsoasoceoseutsen.njlrxn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caokarsoasoceoseutsen.otfake.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caokarsoasoceoseutsen.rfygke.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caokarsoasoceoseutsen.wjgomb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caokarsoasoceoseutsen.xfpmrv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caokarsoasoceoseutsen.xybwxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caokarsoasoceoseutsen.yangyang44.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200009635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caokarsoasoceoseutsen.ykbzoq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caokarsoasoceoseutsen.ynytah.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caokarsoasoceoseutsen.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caokarsoasoceoseutsen.yqpqaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caokarsoasoceoseutsen.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caosarsoasoceoseccsorkutsen.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caosarsoasoceoseccsorkutsen.3968745.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caosarsoasoceoseccsorkutsen.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caosarsoasoceoseccsorkutsen.4687957.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caosarsoasoceoseccsorkutsen.5468785.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caosarsoasoceoseccsorkutsen.8676455.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caosarsoasoceoseccsorkutsen.9978754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caosarsoasoceoseccsorkutsen.auxfvv.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200009648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caosarsoasoceoseccsorkutsen.aymaus.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200009649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caosarsoasoceoseccsorkutsen.eaosey.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caosarsoasoceoseccsorkutsen.hdivud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caosarsoasoceoseccsorkutsen.ijhojg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caosarsoasoceoseccsorkutsen.ilblz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caosarsoasoceoseccsorkutsen.janbl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caosarsoasoceoseccsorkutsen.jbqbcfxgt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caosarsoasoceoseccsorkutsen.nedpvy.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200009656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caosarsoasoceoseccsorkutsen.njlrxn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caosarsoasoceoseccsorkutsen.nzvzoq.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200009658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caosarsoasoceoseccsorkutsen.rfygke.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caosarsoasoceoseccsorkutsen.shzrab.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200009660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caosarsoasoceoseccsorkutsen.vkzpru.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200009661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caosarsoasoceoseccsorkutsen.wjgomb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caosarsoasoceoseccsorkutsen.xfpmrv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caosarsoasoceoseccsorkutsen.xybwxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caosarsoasoceoseccsorkutsen.yangyang44.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200009665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caosarsoasoceoseccsorkutsen.ykbzoq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caosarsoasoceoseccsorkutsen.ynytah.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caosarsoasoceoseccsorkutsen.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caosarsoasoceoseccsorkutsen.yqpqaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caosarsoasoceoseccsorkutsen.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caosarsoasoceoserkutsen.12380978.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caosarsoasoceoserkutsen.1239978.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caosarsoasoceoserkutsen.1366778.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caosarsoasoceoserkutsen.5468785.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caosarsoasoceoserkutsen.6945785.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caosarsoasoceoserkutsen.7786945.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caosarsoasoceoserkutsen.blyqdj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caosarsoasoceoserkutsen.duikdo.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200009678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caosarsoasoceoserkutsen.ilqmcz.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200009679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caosarsoasoceoserkutsen.loqjz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caosarsoasoceoserkutsen.nnawja.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caosarsoasoceoserkutsen.otfake.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caosarsoasoceoserkutsen.wjgomb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caosarsoasoceoserkutsen.wogwe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caosarsoasoceoserkutsen.xfpmrv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caosarsoasoceoserkutsen.xrwetd.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200009686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caosarsoasoceoserkutsen.xybwxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caosarsoasoceoserkutsen.xzeejb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caosarsoasoceoserkutsen.yangyang44.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200009689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caosarsoasoceoserkutsen.ykbzoq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caosarsoasoceoserkutsen.ynytah.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caosarsoasoceoserkutsen.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caosarsoasoceoserkutsen.yqpqaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsed.caosarsoasoceoserkutsen.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsedccao.arsoasoceoseaasrkutsen.1239978.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsedccao.arsoasoceoseaasrkutsen.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsedccao.arsoasoceoseaasrkutsen.3968745.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsedccao.arsoasoceoseaasrkutsen.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsedccao.arsoasoceoseaasrkutsen.4687957.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsedccao.arsoasoceoseaasrkutsen.5468785.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsedccao.arsoasoceoseaasrkutsen.6378791.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsedccao.arsoasoceoseaasrkutsen.7997845.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsedccao.arsoasoceoseaasrkutsen.8676455.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsedccao.arsoasoceoseaasrkutsen.9978754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsedccao.arsoasoceoseaasrkutsen.adijps.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsedccao.arsoasoceoseaasrkutsen.auxfvv.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200009706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsedccao.arsoasoceoseaasrkutsen.hgzklt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsedccao.arsoasoceoseaasrkutsen.wjgomb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsedccao.arsoasoceoseaasrkutsen.xfpmrv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsedccao.arsoasoceoseaasrkutsen.xybwxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsedccao.arsoasoceoseaasrkutsen.yangyang44.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200009711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsedccao.arsoasoceoseaasrkutsen.ykbzoq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsedccao.arsoasoceoseaasrkutsen.ynytah.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsedccao.arsoasoceoseaasrkutsen.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsedccao.arsoasoceoseaasrkutsen.yqpqaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsedccao.arsoasoceoseaasrkutsen.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsedccao.arsoasoceosearkutsen.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsedccao.arsoasoceosearkutsen.366778.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsedccao.arsoasoceosearkutsen.4358879.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsedccao.arsoasoceosearkutsen.5468785.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsedccao.arsoasoceosearkutsen.5633845.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsedccao.arsoasoceosearkutsen.6378791.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsedccao.arsoasoceosearkutsen.7997845.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsedccao.arsoasoceosearkutsen.9978754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsedccao.arsoasoceosearkutsen.adijps.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsedccao.arsoasoceosearkutsen.aljreh.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200009726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsedccao.arsoasoceosearkutsen.hdjyfur.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200009727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsedccao.arsoasoceosearkutsen.hgzklt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsedccao.arsoasoceosearkutsen.ilblz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsedccao.arsoasoceosearkutsen.njlrxn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsedccao.arsoasoceosearkutsen.rfygke.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsedccao.arsoasoceosearkutsen.wjgomb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsedccao.arsoasoceosearkutsen.wogwe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsedccao.arsoasoceosearkutsen.xfpmrv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsedccao.arsoasoceosearkutsen.xybwxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsedccao.arsoasoceosearkutsen.xzeejb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsedccao.arsoasoceosearkutsen.ykbzoq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsedccao.arsoasoceosearkutsen.ynytah.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsedccao.arsoasoceosearkutsen.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsedccao.arsoasoceosearkutsen.yqpqaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoeosncsaasecasorsedccao.arsoasoceosearkutsen.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caokarsoasocoseccsoutsen.12380978.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caokarsoasocoseccsoutsen.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caokarsoasocoseccsoutsen.3968745.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caokarsoasocoseccsoutsen.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caokarsoasocoseccsoutsen.5633845.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caokarsoasocoseccsoutsen.7997845.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caokarsoasocoseccsoutsen.8676455.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caokarsoasocoseccsoutsen.9784585.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caokarsoasocoseccsoutsen.adijps.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caokarsoasocoseccsoutsen.blyqdj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caokarsoasocoseccsoutsen.ijhojg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caokarsoasocoseccsoutsen.nnawja.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caokarsoasocoseccsoutsen.wjgomb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caokarsoasocoseccsoutsen.xfpmrv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caokarsoasocoseccsoutsen.xybwxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caokarsoasocoseccsoutsen.ykbzoq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caokarsoasocoseccsoutsen.ynytah.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caokarsoasocoseccsoutsen.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caokarsoasocoseccsoutsen.yqpqaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caokarsoasocoseccsoutsen.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caokarsoasocoseutsen.5468785.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caokarsoasocoseutsen.6978458.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caokarsoasocoseutsen.8676455.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caokarsoasocoseutsen.aymaus.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200009765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caokarsoasocoseutsen.fzcvxp.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200009766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caokarsoasocoseutsen.hgzklt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caokarsoasocoseutsen.ilblz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caokarsoasocoseutsen.janbl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caokarsoasocoseutsen.jbqbcfxgt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caokarsoasocoseutsen.nedpvy.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200009771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caokarsoasocoseutsen.vkzpru.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200009772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caokarsoasocoseutsen.wjgomb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caokarsoasocoseutsen.xfpmrv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caokarsoasocoseutsen.xrwetd.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200009775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caokarsoasocoseutsen.xybwxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caokarsoasocoseutsen.xzeejb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caokarsoasocoseutsen.ykbzoq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caokarsoasocoseutsen.ynytah.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caokarsoasocoseutsen.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caokarsoasocoseutsen.yqpqaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caokarsoasocoseutsen.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caosarsoasocoseccsorkutsen.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caosarsoasocoseccsorkutsen.4687957.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caosarsoasocoseccsorkutsen.5468785.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caosarsoasocoseccsorkutsen.6378791.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caosarsoasocoseccsorkutsen.6945785.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caosarsoasocoseccsorkutsen.6978458.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caosarsoasocoseccsorkutsen.8676455.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caosarsoasocoseccsorkutsen.9978754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caosarsoasocoseccsorkutsen.adijps.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caosarsoasocoseccsorkutsen.aljreh.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200009792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caosarsoasocoseccsorkutsen.fzcvxp.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200009793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caosarsoasocoseccsorkutsen.hdivud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caosarsoasocoseccsorkutsen.hgzklt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caosarsoasocoseccsorkutsen.ijhojg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caosarsoasocoseccsorkutsen.ilqmcz.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200009797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caosarsoasocoseccsorkutsen.jbqbcfxgt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caosarsoasocoseccsorkutsen.loqjz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caosarsoasocoseccsorkutsen.njlrxn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caosarsoasocoseccsorkutsen.nnawja.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caosarsoasocoseccsorkutsen.nzvzoq.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200009802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caosarsoasocoseccsorkutsen.wjgomb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caosarsoasocoseccsorkutsen.xfpmrv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caosarsoasocoseccsorkutsen.xrwetd.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200009805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caosarsoasocoseccsorkutsen.xybwxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caosarsoasocoseccsorkutsen.yangyang44.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200009807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caosarsoasocoseccsorkutsen.ykbzoq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caosarsoasocoseccsorkutsen.ynytah.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caosarsoasocoseccsorkutsen.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caosarsoasocoseccsorkutsen.yqpqaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caosarsoasocoseccsorkutsen.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caosarsoasocoserkutsen.4358879.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caosarsoasocoserkutsen.5468785.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caosarsoasocoserkutsen.6378791.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caosarsoasocoserkutsen.6945785.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caosarsoasocoserkutsen.9784585.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caosarsoasocoserkutsen.aljreh.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200009818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caosarsoasocoserkutsen.ankdujfkx.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200009819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caosarsoasocoserkutsen.hdivud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caosarsoasocoserkutsen.janbl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caosarsoasocoserkutsen.loqjz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caosarsoasocoserkutsen.nedpvy.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200009823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caosarsoasocoserkutsen.neqnpg.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200009824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caosarsoasocoserkutsen.shzrab.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200009825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caosarsoasocoserkutsen.wjgomb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caosarsoasocoserkutsen.xfpmrv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caosarsoasocoserkutsen.xybwxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caosarsoasocoserkutsen.ykbzoq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caosarsoasocoserkutsen.ynytah.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caosarsoasocoserkutsen.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caosarsoasocoserkutsen.yqpqaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsed.caosarsoasocoserkutsen.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsedccao.arsoasocoseaasrkutsen.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsedccao.arsoasocoseaasrkutsen.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsedccao.arsoasocoseaasrkutsen.6978458.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsedccao.arsoasocoseaasrkutsen.7786945.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsedccao.arsoasocoseaasrkutsen.7997845.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsedccao.arsoasocoseaasrkutsen.93544117.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsedccao.arsoasocoseaasrkutsen.9784585.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsedccao.arsoasocoseaasrkutsen.9978754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsedccao.arsoasocoseaasrkutsen.adijps.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsedccao.arsoasocoseaasrkutsen.aljreh.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200009843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsedccao.arsoasocoseaasrkutsen.aymaus.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200009844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsedccao.arsoasocoseaasrkutsen.eaosey.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsedccao.arsoasocoseaasrkutsen.jbqbcfxgt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsedccao.arsoasocoseaasrkutsen.nedpvy.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200009847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsedccao.arsoasocoseaasrkutsen.njlrxn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsedccao.arsoasocoseaasrkutsen.otfake.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsedccao.arsoasocoseaasrkutsen.wjgomb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsedccao.arsoasocoseaasrkutsen.wogwe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsedccao.arsoasocoseaasrkutsen.xfpmrv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsedccao.arsoasocoseaasrkutsen.xybwxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsedccao.arsoasocoseaasrkutsen.ykbzoq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsedccao.arsoasocoseaasrkutsen.ynytah.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsedccao.arsoasocoseaasrkutsen.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsedccao.arsoasocoseaasrkutsen.yqpqaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsedccao.arsoasocoseaasrkutsen.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsedccao.arsoasocosearkutsen.12380978.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsedccao.arsoasocosearkutsen.3968745.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsedccao.arsoasocosearkutsen.5633845.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsedccao.arsoasocosearkutsen.7997845.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsedccao.arsoasocosearkutsen.8676455.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsedccao.arsoasocosearkutsen.9784585.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsedccao.arsoasocosearkutsen.adijps.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsedccao.arsoasocosearkutsen.blyqdj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsedccao.arsoasocosearkutsen.hdivud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsedccao.arsoasocosearkutsen.loqjz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsedccao.arsoasocosearkutsen.njlrxn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200009869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsedccao.arsoasocosearkutsen.wjgomb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsedccao.arsoasocosearkutsen.xfpmrv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsedccao.arsoasocosearkutsen.xybwxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsedccao.arsoasocosearkutsen.ykbzoq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsedccao.arsoasocosearkutsen.ynytah.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsedccao.arsoasocosearkutsen.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsedccao.arsoasocosearkutsen.yqpqaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketcoesncsaasecasorsedccao.arsoasocosearkutsen.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoesnccsaasecasorsed.caaaosearescoooseccsorkutsen.1978777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoesnccsaasecasorsed.caarokearescoooseccsoutsen.urolol.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoesnccsaasecasorsedcceaoo.earescooosearkutsen.sswfzk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.0633348.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.1223478.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.15537777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.2354387.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.2355587.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.3333347.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.3456588.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.3533357.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.3545331.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.3556678.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.3888347.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.4478687.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.4488877.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.4566368.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.4566878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.4678865.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.4687999.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.5378887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.5387814.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.6123878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.6366778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.6788777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.6788877.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.6887453.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.6975877.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.6979885.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.7688477.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.7788513.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.9556788.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.9978777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.9997854.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.9997875.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.ahiatgp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.ahibtgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.ahictgl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.ahidtgf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.ahigtgg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.ahihtgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.avmueo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.biyzde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.bozoob.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.fmrxl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.gpsjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.hdjtd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.ipnnct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.iwggbt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.izokl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.jayocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.jqwgwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.kbjbz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.lheqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.mhftfp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.npibd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.ohvcp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.ojpih.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.pfbueg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.plcxj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.qglno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.qqwhps.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.rbfmfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.sfts.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200009950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.sfts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.uynfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.velxb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.vnbxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.vppvl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.xopup.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.ylbde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.ymgar.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.aasccsorkutsen.ypzcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.0633348.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.1223478.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.15537777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.2354387.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.2355587.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.3333347.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.3456588.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.3533357.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.3545331.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.3556678.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.3888347.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.4478687.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.4488877.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.4566368.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.4566878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.4678865.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.4687999.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.5378887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.5387814.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.6123878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.6366778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.6788777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.6788877.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.6887453.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.6975877.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.6979885.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.7688477.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.7788513.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.9556788.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.9978777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.9997854.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.9997875.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200009996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.ahiatgp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.ahibtgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.ahictgl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200009999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.ahidtgf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.ahigtgg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.ahihtgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.avmueo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.biyzde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.bozoob.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.cderfv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.fmrxl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.gpsjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.hdjtd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.ipnnct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.iwggbt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.izokl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.jayocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.jqwgwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.kbjbz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.lheqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.mengdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.mhftfp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.npibd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.ohvcp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.ojpih.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.pfbueg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.plcxj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.qglno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.qqwhps.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.rbfmfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.sfts.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200010032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.sfts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.uynfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.velxb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.vnbxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.vppvl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.xopup.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.ylbde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.ymgar.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkccsoutsen.ypzcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.6123878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.6366778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.6788777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.6788877.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.6887453.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.6975877.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.6979885.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.7688477.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.7788513.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.9556788.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.9978777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.9997854.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.9997875.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.ahiatgp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.ahibtgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.ahictgl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.ahidtgf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.ahigtgg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.ahihtgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.avmueo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.biyzde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.bozoob.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.fmrxl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.gpsjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.hdjtd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.ipnnct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.iwggbt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.izokl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.jayocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.jqwgwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.kbjbz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.lheqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.lsaaas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.lsksodi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.mhftfp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.npibd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.ohvcp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.ojpih.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.pfbueg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.plcxj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.qglno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.qqwhps.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.rbfmfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.sfts.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200010094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.sfts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.uynfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.velxb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.vnbxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.vppvl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.xopup.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.ylbde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.ymgar.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasord.arkutsen.ypzcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.0633348.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.1223478.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.15537777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.2354387.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.2355587.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.3333347.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.3456588.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.3533357.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.3545331.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.3556678.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.3888347.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.4478687.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.4488877.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.4566368.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.4566878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.4678865.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.4687999.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.5378887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.5387814.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.6123878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.6366778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.6788777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.6788877.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.6887453.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.6975877.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.6979885.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.7688477.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.7788513.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.9556788.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.9978777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.9997854.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.9997875.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.ahiatgp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.ahibtgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.ahictgl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.ahidtgf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.ahigtgg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.ahihtgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.avmueo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.biyzde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.bozoob.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.cderfv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.fmrxl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.gpsjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.hdjtd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.ipnnct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.iwggbt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.izokl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.jayocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.jqwgwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.kbjbz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.lheqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.lsksodi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.mhftfp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.npibd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.ohvcp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.ojpih.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.pfbueg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.plcxj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.qglno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.qqwhps.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.rbfmfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.sfts.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200010176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.sfts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.uynfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.velxb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.vnbxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.vppvl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.xopup.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.ylbde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.ymgar.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.aasrkutsen.ypzcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.0633348.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.1223478.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.15537777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.2354387.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.2355587.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.3333347.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.3456588.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.3533357.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.3545331.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.3556678.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.3888347.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.4478687.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.4488877.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.4566368.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.4566878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.4678865.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.4687999.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.5378887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.5387814.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.6123878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.6366778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.6788777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.6788877.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.6887453.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.6975877.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.6979885.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.7688477.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.7788513.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.9556788.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.9978777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.9997854.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.9997875.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.ahiatgp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.ahibtgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.ahictgl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.ahidtgf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.ahigtgg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.ahihtgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.avmueo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.biyzde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.bozoob.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.fmrxl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.gpsjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.hdjtd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.ipnnct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.iwggbt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.izokl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.jayocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.jqwgwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.kbjbz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.lheqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.lokasid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.lslois.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.mhftfp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.npibd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.ohvcp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.ojpih.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.pfbueg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.plcxj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.qglno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.qqwhps.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.rbfmfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.sfts.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200010258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.sfts.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200010259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.sfts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.uynfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.velxb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.vnbxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.vppvl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.xopup.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.ylbde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.ymgar.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketoncasordceo.arkutsen.ypzcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.aasascoseccsorkutsen.bjdsqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.aasascoseccsorkutsen.cipgmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.aasascoseccsorkutsen.coinwallet.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.aasascoseccsorkutsen.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.aasascoseccsorkutsen.drqelj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.aasascoseccsorkutsen.ewdbda.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.aasascoseccsorkutsen.hzzpvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.aasascoseccsorkutsen.jaftcq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.aasascoseccsorkutsen.kobagq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.aasascoseccsorkutsen.kzstoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.aasascoseccsorkutsen.mrogod.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.aasascoseccsorkutsen.nthuga.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.aasascoseccsorkutsen.owbxts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.aasascoseccsorkutsen.tilgij.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.aasascoseccsorkutsen.tohjkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.aasascoseccsorkutsen.uhijmv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.aasascoseccsorkutsen.umjnpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.aasascoseccsorkutsen.uobmas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.aasascoseccsorkutsen.vgedvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.aasascoseccsorkutsen.vvdmwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.aasascoserkutsen.1157777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.aasascoserkutsen.3354788.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.aasascoserkutsen.asxrvb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.aasascoserkutsen.aulscd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.aasascoserkutsen.cartil.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.aasascoserkutsen.coinwallet.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.aasascoserkutsen.dsyqit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.aasascoserkutsen.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.aasascoserkutsen.gvtkxq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.aasascoserkutsen.gwrrdx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.aasascoserkutsen.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.aasascoserkutsen.jaftcq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.aasascoserkutsen.kihmid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.aasascoserkutsen.kvivli.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.aasascoserkutsen.kzstoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.aasascoserkutsen.pajngn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.aasascoserkutsen.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.aasascoserkutsen.rhurgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.aasascoserkutsen.sbelxi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.aasascoserkutsen.sdutxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.aasascoserkutsen.sfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.aasascoserkutsen.sfts.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200010311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.aasascoserkutsen.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.aasascoserkutsen.ugelbf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.aasascoserkutsen.umjnpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.aasascoserkutsen.vgedvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.aasascoserkutsen.vjkyoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.aasascoserkutsen.wfmcjb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.aasascoserkutsen.xchztf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.aasascoserkutsen.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.aasascoserkutsen.yalpuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.aasascoserkutsen.yczpuk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseccsoutsen.2124458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseccsoutsen.a80117.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200010323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseccsoutsen.asxrvb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseccsoutsen.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseccsoutsen.cartil.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseccsoutsen.cipgmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseccsoutsen.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseccsoutsen.dsyqit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseccsoutsen.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseccsoutsen.flyveb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseccsoutsen.fuufvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseccsoutsen.hzwrnd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseccsoutsen.jtpyia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseccsoutsen.kihmid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseccsoutsen.kobagq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseccsoutsen.ksiudjfo.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseccsoutsen.kvivli.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseccsoutsen.msqkez.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseccsoutsen.mwojiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseccsoutsen.ojfyvi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseccsoutsen.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseccsoutsen.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseccsoutsen.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseccsoutsen.rhurgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseccsoutsen.sdutxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseccsoutsen.sfts.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200010347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseccsoutsen.tdvpct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseccsoutsen.tohjkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseccsoutsen.ugelbf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseccsoutsen.uhijmv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseccsoutsen.vgedvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseccsoutsen.xchztf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseccsoutsen.xeoadw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseccsoutsen.xmlqpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseccsoutsen.yagtso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseccsoutsen.yczpuk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseccsoutsen.yezuns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseccsoutsen.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseutsen.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseutsen.a80117.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200010361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseutsen.aulscd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseutsen.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseutsen.cipgmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseutsen.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseutsen.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseutsen.gvtkxq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseutsen.hzwrnd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseutsen.jtpyia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseutsen.mrogod.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseutsen.mwojiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseutsen.rhurgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseutsen.sbelxi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseutsen.sfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseutsen.tilgij.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseutsen.tohjkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseutsen.vfelco.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseutsen.vvdmwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseutsen.vyihmf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseutsen.xjdpgi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasord.arkascoseutsen.xmlqpz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascoseaasrkutsen.aulscd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascoseaasrkutsen.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascoseaasrkutsen.cemlfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascoseaasrkutsen.cipgmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascoseaasrkutsen.coinwallet.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascoseaasrkutsen.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascoseaasrkutsen.drqelj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascoseaasrkutsen.dsyqit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascoseaasrkutsen.dwrnsk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascoseaasrkutsen.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascoseaasrkutsen.flyveb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascoseaasrkutsen.gwrlwh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascoseaasrkutsen.hzwrnd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascoseaasrkutsen.hzzpvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascoseaasrkutsen.ksiudjfo.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascoseaasrkutsen.kvivli.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascoseaasrkutsen.kzstoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascoseaasrkutsen.mrogod.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascoseaasrkutsen.mwojiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascoseaasrkutsen.nlcrmz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascoseaasrkutsen.ojfyvi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascoseaasrkutsen.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascoseaasrkutsen.sdutxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascoseaasrkutsen.sfts.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200010405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascoseaasrkutsen.tilgij.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascoseaasrkutsen.umjnpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascoseaasrkutsen.vgedvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascoseaasrkutsen.vvdmwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascoseaasrkutsen.wfmcjb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascoseaasrkutsen.xchztf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascoseaasrkutsen.yczpuk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascoseaasrkutsen.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascosearkutsen.3354788.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascosearkutsen.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascosearkutsen.cemlfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascosearkutsen.chaincomp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascosearkutsen.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascosearkutsen.eesnax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascosearkutsen.ewdbda.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascosearkutsen.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascosearkutsen.gvtkxq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascosearkutsen.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascosearkutsen.jaftcq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascosearkutsen.jcqpfm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascosearkutsen.kihmid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascosearkutsen.kzstoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascosearkutsen.msqkez.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascosearkutsen.qjgmxi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascosearkutsen.sbelxi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascosearkutsen.sfts.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200010431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascosearkutsen.tdvpct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascosearkutsen.tilgij.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascosearkutsen.tohjkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascosearkutsen.ugelbf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascosearkutsen.uhijmv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascosearkutsen.uobmas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascosearkutsen.vjzvtr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascosearkutsen.vyihmf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascosearkutsen.wfmcjb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascosearkutsen.xchztf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascosearkutsen.yczpuk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raketonccasecasordceo.ascosearkutsen.yezuns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakuten-card.co.jp.cfljkl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakuten-card.co.jp.hfklrs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakuten-sg.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200010446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakuten.gardenone.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200010447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rakutenetopd.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raky-637891.ingress-earth.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200010449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ramsonstransport.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ranierimarineparts.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200010451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rapid-violet-1069.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200010452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rapporti-bancari-ed-operare.misecure.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rarbille.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rarebli.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raspy-king-4ed0.settingspaqesapp.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200010456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raspy-water-dcc2.beanwoodnode.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200010457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rauchenbergerlenggries.clickfunnels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raulsshack.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raycargo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raydinum.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raydium.gifts"; content:"Host"; http_header; classtype:attempted-recon; sid:200010462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raydiumprotocol.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200010463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rayidium.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"raynau.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rbcmontgomery.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rbtnr.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200010467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rc.tintasrc.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200010468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcubebit.bitbucket.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200010469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcvry.sftyacn.scrthlp.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200010470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rcvry.sprt.acn-cnfrm.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200010471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rdeku.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rdhtire.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200010473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"re-redirection-acc-id923872635122.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reactivatepage-67585.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200010475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reactiwqsdadsd3a.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200010476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"realesign.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"realsaude.pt"; content:"Host"; http_header; classtype:attempted-recon; sid:200010478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"realtymeets.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rebategrow.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rechnunge.wpengine.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"recoveraccpagesystte32512111111111.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"recovery-fb.secure-acct.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200010483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rectifystation.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"recuperaciondecuenta-12b0.czemarkojo.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200010485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"recvry-page-protection-comunity-problems-4511854278.web.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200010486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"recvry-page-protection-comunity-problems-45748235.web.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200010487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"recvry-page-protection-comunity-problems-4574823542.web.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200010488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"red.bx.securedconnection.mallorcaextremesports.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"redbysfrgroupebox.myfreesites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200010490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rede-gerenciadorcx-multiassistencia.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"redeem-microsoft-code.sitey.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200010492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"redeliver-aus-post.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"redeliver-aus-post.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rediractionid547012016089540218057.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"redirection-b836d.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"redjuvenilignaciana.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200010497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"redstonekidsacademy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reg-3da7f.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reg123r.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"regamtas.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"regect-db.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200010502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"regelikbeheer.nl"; content:"Host"; http_header; classtype:attempted-recon; sid:200010503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"regionalezeknozoyda.flazio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"register.pinnedfun.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"register.templejoy.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200010506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"registradigital.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reine142.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reinforcementdetail.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200010509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rekvk31l.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200010510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reliablehomesbd.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"remdxhosk.opulentspectrum.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"remeslnik-praha.cz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"remototarget.ihostfull.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"remove-restrictions-jp.hucrm.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200010515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"remove-restrictions-jp.ryxepeb.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200010516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"remove-restrictions-jp.xmedvhz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200010517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"renew.trusted-travelers-online.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"repl-mess.myfreesites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200010519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"reprogram-online.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200010520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"request-payment-cancel.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"request.br.ironmountain.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"requestinteriumtlc6e6requestin.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"res-va.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"resgatequatar.eastasia.cloudapp.azure.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"resgtpontossl.3utilities.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"resimyukle.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200010527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"resolvendo-registro-solucoes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"resotrargsantder19378250.qc.lu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"restles.ndkdjndnnd.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200010530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"retiro.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200010531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"retsollu01.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rev.sfr.net.gghost.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200010533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"revboosters.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"revc.wwwirasgov-sgloginesvweb.sbs"; content:"Host"; http_header; classtype:attempted-recon; sid:200010535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"review.wecu3.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rewardsyncdappssconnect.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rfgdcvn.nceqcaq.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200010538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rfgegdsfghdfhfds.x10.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200010539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rfgegdsfghdfhfdssada.x10.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200010540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rfyghbuh.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rhitomsarkar.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200010542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ricebenefitsandinvestments.squarespace.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"richgodsnft.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ricohcounters.com.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200010545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rigid-driving.surge.sh"; content:"Host"; http_header; classtype:attempted-recon; sid:200010546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rise-recreational-and-medical-cannabis-delivery.jimdosite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"risedefenders.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200010548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"risemedicalmarijuanadisp.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"risersmn.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"riveroflife.org.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200010551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rjodtib3yn0gtp6rzp22fnttj.qwo231sdx.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200010552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ro0vc.app.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200010553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"robertcarlsonlaw.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roccobonheur1-my-cheetah-website-copy.cheetah.builderall.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rodrigotristao.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200010556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rodriguezadams.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roger.red"; content:"Host"; http_header; classtype:attempted-recon; sid:200010558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roisnoob.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200010559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rollinindoughcakes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rollsingh.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200010561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"romxn96.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200010562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ronin-wallet.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ronin-wallet.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roninchain.website"; content:"Host"; http_header; classtype:attempted-recon; sid:200010565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roninwallet-official.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roninwallet-ph.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roninwallet.cm"; content:"Host"; http_header; classtype:attempted-recon; sid:200010568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roominspo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roongsin.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rosshw.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roundcube-5ae8a.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roundcube-5ae8a.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roundcube-cpanel-wren.surge.sh"; content:"Host"; http_header; classtype:attempted-recon; sid:200010574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roundcube-updatealx.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"roundcube-updatealx.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rouninwalet.mobirisesite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rowan-gentle-suede.glitch.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200010578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"royal-mails.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"royal-mode-1212.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200010580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"royal9990.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rqjyt2o.qwo231sdx.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200010582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rqlredw.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200010583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rqubw.nnicag.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rrarrible-nft.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200010585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rrfdaes.lcuouqr.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200010586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rriwy8.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200010587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rrreeetyu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rsmpoly.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ru-pancakeswap.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rubrique-espaceclient.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rudydoo56.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ruloxx.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rummymakmur.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"runn.dvo9xhl0ud318.amplifyapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rural.20-200-214-205.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200010596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rural.page.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200010597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ruralshop.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rust-raffle.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rususia.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rweasv.ehcjay.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200010601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rws.ac.th"; content:"Host"; http_header; classtype:attempted-recon; sid:200010602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ryanlerch.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200010603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"rzobeelg1-001-site1.itempurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"s-fa31f3-i.sgizmo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"s.free.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200010606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"s.smart-fixhub.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200010607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"s.yam.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"s1.o-rln.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200010609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"s104318.gridserver.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"s117.panelboxmanager.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"s23.proserv.ge"; content:"Host"; http_header; classtype:attempted-recon; sid:200010612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"s3.ap-southeast-2.wasabisys.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"s427588.ha003.t.justns.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200010614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"s8377hitvon48q3t8.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200010615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sabbirahmed3716.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200010616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaiseoncassed.ascsord.mmhexw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaiseoncassed.ascsord.ofuhhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaiseoncassed.ascsord.pcmubo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaiseoncassed.ascsord.pwnqil.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaiseoncassed.ascsord.qsnuwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaiseoncassed.ascsord.rlwlqg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaiseoncassed.ascsord.wnmoss.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaiseosncasseid.casocsord.moidld.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaiseosncasseid.casocsord.mrcvaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaiseosncasseid.casocsord.ooybpr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaiseosncasseid.casocsord.oyvwhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaiseosncasseid.casocsord.pwnqil.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaiseosncasseid.casocsord.pynfib.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaiseosncasseid.casocsord.qzhrsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaiseosncasseid.casocsord.rmpqkw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaiseosncasseid.casocsord.tkzpfo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaiseosncasseid.casocsord.tqpvuk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaiseosncasseid.casocsord.wnmoss.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaisseonccasseesd.ascsord.lsjtuz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaisseonccasseesd.ascsord.moidld.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaisseonccasseesd.ascsord.nstwud.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaisseonccasseesd.ascsord.pekbwh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaisseonccasseesd.ascsord.pguyrk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaisseonccasseesd.ascsord.pwgdsb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaisseonccasseesd.ascsord.pwnqil.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaisseonccasseesd.ascsord.pxrdtj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaisseonccasseesd.ascsord.qnilfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaisseoscncasseseid.casocsord.moidld.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaisseoscncasseseid.casocsord.nupxij.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaisseoscncasseseid.casocsord.ofojhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaisseoscncasseseid.casocsord.ooybpr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaisseoscncasseseid.casocsord.oszusw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaisseoscncasseseid.casocsord.pfqmmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaisseoscncasseseid.casocsord.prxtir.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaisseoscncasseseid.casocsord.qvpsgp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaisseoscncasseseid.casocsord.tkzpfo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaisseoscncasseseid.casocsord.tqpvuk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaisseoscncasseseid.casocsord.tzrwxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaivseseoncassed.ascccasesord.mmhexw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaivseseoncassed.ascccasesord.ofuhhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaivseseoncassed.ascccasesord.oyvwhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaivseseoncassed.ascccasesord.prjsxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaivseseoncassed.ascccasesord.qnilfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaivseseoncassed.ascccasesord.raqgoh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaivseseoncassed.ascccasesord.rmpqkw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaivseseoncassed.ascccasesord.slucdk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaivseseoncassed.ascccasesord.syrdtj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaivseseoncassed.ascccasesord.tsmhjl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaivseseoncassed.ascccasesord.wnmoss.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaivseseosncasseid.cccaseasocsord.ofuhhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaivseseosncasseid.cccaseasocsord.ooybpr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaivseseosncasseid.cccaseasocsord.oyvwhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaivseseosncasseid.cccaseasocsord.pexlcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaivseseosncasseid.cccaseasocsord.prxtir.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaivseseosncasseid.cccaseasocsord.pwnqil.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaivseseosncasseid.cccaseasocsord.pynfib.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaivseseosncasseid.cccaseasocsord.qnilfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaivseseosncasseid.cccaseasocsord.qsnuwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaivseseosncasseid.cccaseasocsord.rjoxxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaivseseosncasseid.cccaseasocsord.rxyavd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaivseseosncasseid.cccaseasocsord.tsmhjl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaivseseosncasseid.cccaseasocsord.vhyyuk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaivseseosncasseid.cccaseasocsord.vlyvyk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaivsesseonccasseesdccase.ascsord.nupxij.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaivsesseonccasseesdccase.ascsord.odemem.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaivsesseonccasseesdccase.ascsord.ooybpr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaivsesseonccasseesdccase.ascsord.oszusw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaivsesseonccasseesdccase.ascsord.pazooa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaivsesseonccasseesdccase.ascsord.pcmubo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaivsesseonccasseesdccase.ascsord.pexlcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaivsesseonccasseesdccase.ascsord.pwnqil.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaivsesseonccasseesdccase.ascsord.vgftqx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaivsesseonccasseesdccase.ascsord.vpgwke.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaivsesseoscncasseseccaseid.casocsord.myeqsi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaivsesseoscncasseseccaseid.casocsord.ooybpr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaivsesseoscncasseseccaseid.casocsord.pazooa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaivsesseoscncasseseccaseid.casocsord.pcmubo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaivsesseoscncasseseccaseid.casocsord.pekbwh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaivsesseoscncasseseccaseid.casocsord.pfqmmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaivsesseoscncasseseccaseid.casocsord.pwnqil.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacaivsesseoscncasseseccaseid.casocsord.pynfib.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sacmhs.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sadervoyages.intnet.mu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saeisocein.scaseceoe.ijzy.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200010700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saeisocein.scaseceoe.quanshikong.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200010701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saeisocein.scaseceoe.wetot.world"; content:"Host"; http_header; classtype:attempted-recon; sid:200010702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saeisocen.scaseeoe.01ov.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saeisocen.scaseeoe.yviwho.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saeisocen.scaseeoe.zgepsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saeisocen.scaseeoe.zstyum.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saeisoen.scaseoe.ihetao.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200010707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saeisoen.scaseoe.xwjimg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saeisoen.scaseoe.xxbjzt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saesocciin.scasecein.footballs.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200010710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saesocciin.scasecein.harford.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200010711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saesocin.scasein.rictwz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saesocin.scasein.wetot.work"; content:"Host"; http_header; classtype:attempted-recon; sid:200010713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saesocin.scasein.ycqdte.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"safemintnft.silvertrade.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"safemoonstk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"safraempresas.com.br.mcas-df.ms"; content:"Host"; http_header; classtype:attempted-recon; sid:200010717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"safty.summarycheck.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200010718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sahleymadison.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saika69sex.monster"; content:"Host"; http_header; classtype:attempted-recon; sid:200010720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saintbarkleyshoes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saisceeons.soaisecon.apmpqg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saisceeons.soaisecon.gpghar.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saisceeons.soaisecon.hnekal.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saisceeons.soaisecon.htuygn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saisceeons.soaisecon.jxajmg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saisceesosn.osacisecon.flvxkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saisceesosn.osacisecon.hxfzlp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saisceon.saisecon.axxgwf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saisceon.saisecon.dzzeqx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saisceon.saisecon.etsffm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saisceon.saisecon.gdubei.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saisceon.saisecon.hjvbkp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saisceon.saisecon.kcdhgz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saisceson.sacisecon.axxgwf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saisceson.sacisecon.dferdn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saisceson.sacisecon.elvlic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saisceson.sacisecon.fgdhff.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saisceson.sacisecon.fsmiwc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saisceson.sacisecon.fttznl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saisceson.sacisecon.gimhld.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saisceson.sacisecon.hqmwaa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saisceson.sacisecon.hvolmq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saisceson.sacisecon.jbsdyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiseoccin.saeseceon.ippq.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200010745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiseoccn.saeseeon.fashions.show"; content:"Host"; http_header; classtype:attempted-recon; sid:200010746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiseoccn.saeseeon.wetot.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200010747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiseoccn.saeseeon.zgepsq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiseocn.saeseon.00jd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiseocn.saeseon.iyouqiu.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200010750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saiseocn.saeseon.wnsvnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saitadobrasil.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200010752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sakisang.bwbkqud.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200010753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"salamalands.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saliksnas.lojaintegrada.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200010755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"salmanfarsi01.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200010756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"salvereginaecuador.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"samuelscott.ca"; content:"Host"; http_header; classtype:attempted-recon; sid:200010758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"samvision.com.tr"; content:"Host"; http_header; classtype:attempted-recon; sid:200010759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"samvoktor.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"san-dbox-home-lojaprincipessa.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sanasunty.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200010762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sanatanastrology.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sandbox.the-cave.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200010764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sandclaim.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sandeeppk03.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200010766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sangleemd.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sanjilkumar.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sankyo-m.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200010769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"santa565sac.ultimatefreehost.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200010770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saosaion.sacaoion.acucbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saosaion.sacaoion.aformd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saosaion.sacaoion.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saosaion.sacaoion.avqtnx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saosaion.sacaoion.bdlzvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saosaion.sacaoion.bmozhr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saosaion.sacaoion.cormdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saosaion.sacaoion.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saosaion.sacaoion.dcvcfq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saosaion.sacaoion.dhvprp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saosaion.sacaoion.dxjcrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saosaion.sacaoion.ehbrwp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saosaion.sacaoion.ejxxpq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saosaion.sacaoion.fntxet.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saosaion.sacaoion.focamc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saosaion.sacaoion.gqnrcz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saosaion.sacaoion.haflwi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saosaion.sacaoion.hlnifq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saosaion.sacaoion.hupxqb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saosaion.sacaoion.ibyljb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saosaion.sacaoion.iesklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saosaion.sacaoion.ikmkwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saosaion.sacaoion.xvebfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saosaion.sacaoion.yaaabg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saosaion.sacaoion.yiyingzf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saosaion.sacaoion.ypznyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saosaion.sacaoion.ywmdmi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saosaion.sacaoion.zbqfwh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saosaion.sacaoion.zimawr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saosaion.sacaoion.zipdjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saosaion.sacaoion.zlrrpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasaion.sacasison.ablndk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasaion.sacasison.adqdwg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasaion.sacasison.aformd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasaion.sacasison.avqtnx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasaion.sacasison.bdctxj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasaion.sacasison.cbmikk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasaion.sacasison.chgskm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasaion.sacasison.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasaion.sacasison.dborfs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasaion.sacasison.dqbskq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasaion.sacasison.dxjcrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasaion.sacasison.ejxxpq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasaion.sacasison.erxemo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasaion.sacasison.fntxet.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasaion.sacasison.focamc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasaion.sacasison.haflwi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasaion.sacasison.hfblsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasaion.sacasison.hiqgjp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasaion.sacasison.hlnifq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasaion.sacasison.hxsyjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasaion.sacasison.wpoawh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasaion.sacasison.xjkfdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasaion.sacasison.xlftxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasaion.sacasison.xlokjz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasaion.sacasison.ypznyd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasaion.sacasison.zbomvh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasaion.sacasison.zfeixc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasaion.sacasison.zhxqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasaion.sacasison.zimawr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sasaion.sacasison.zqewer.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sascaiion.sacasion.acucbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sascaiion.sacasion.adqdwg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sascaiion.sacasion.aiabsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sascaiion.sacasion.ajiuwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sascaiion.sacasion.bmqbxi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sascaiion.sacasion.cormdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sascaiion.sacasion.dxjcrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sascaiion.sacasion.eiaohy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sascaiion.sacasion.ejxxpq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sascaiion.sacasion.focamc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sascaiion.sacasion.fokvsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sascaiion.sacasion.fxojqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sascaiion.sacasion.haflwi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sascaiion.sacasion.hiqgjp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sascaiion.sacasion.hlnifq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sascaiion.sacasion.ibyljb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sascaiion.sacasion.wpoawh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sascaiion.sacasion.xjkfdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sascaiion.sacasion.xnskxw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sascaiion.sacasion.xtpqhy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sascaiion.sacasion.yltsps.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sascaiion.sacasion.zipdjw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sascaiion.sacasion.zlrrpi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"satay-secur.reconfimations.pagedisabled.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200010855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"satgobmx.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"satisfy.yxti.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200010857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"saugaatfoods.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"savingsfordentalcare.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sbcglobal-verification38.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sblfitness.ca"; content:"Host"; http_header; classtype:attempted-recon; sid:200010861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sbloccare-sicuro-conto-com.preview-domain.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sbs-siebanlagen.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200010863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sbxqpfo.cluster029.hosting.ovh.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200010864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sc-01111000.ihostfull.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scaiecasn.sescaoin.qiyi.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200010866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scaieccaisn.seseccaoin.mcclure.group"; content:"Host"; http_header; classtype:attempted-recon; sid:200010867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scaieccaisn.seseccaoin.wnsvnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scaieccaisn.seseccaoin.znqehi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scaieccasn.sesecaoin.wetot.kim"; content:"Host"; http_header; classtype:attempted-recon; sid:200010870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scaieccasn.sesecaoin.wnsvnv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scaieccasn.sesecaoin.zhaotata.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200010872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scanoffice365-owa4874.microsoft365scan.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200010873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sceiplc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"schmittner.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200010875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"school.greenislandtrust.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scl-leagua.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200010877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sclswisscom.flazio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scmcb-crads.bt5173.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200010879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sco1992999.ultimatefreehost.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200010880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scrocketry.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scrty.cold-thunder-d531.siteacn.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200010882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scrtyinfobusspage.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"scvds.mzfyfaw.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200010884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sdfds.uysiqjp.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200010885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sdffsf.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sdgh765.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200010887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sdgvsdvsdvs.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"se-connecter-au-webmail-la-poste1.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"se-connecter-au-webmail-lapostenet.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seafooddeliveryapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seamb-saacmb.1105sss.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seamb-saacmb.4-4-j-zzd17.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seamb-saacmb.cinoe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seamb-saacmb.cvxot.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seamb-saacmb.eoewz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seamb-saacmb.viitt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seamb-saacmb.vipjym1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seamb-saacmb.xnxrr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200010899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"searchnama.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sebat-dhl.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sebene27.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200010902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sec-d5cc6.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secittystrisaccountsifneotyss.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sectrrysudaptesidetiysssinfo.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200010905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"securauth-ageverification.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure-alpha-497da0be515757web.gidiagents.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure-code-project.reseeoniwean.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200010908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure-document-project.ereoveisnot.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200010909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure-nab.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200010910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure-online.4nmn.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure-reconnect.dinamic-ourtime.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200010912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure-runescape.xgm.rnp.mybluehost.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200010913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure-sligth-document.ertoolfo.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200010914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure-ups-canada.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure-vent.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200010916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure-wallet-connect.ipq.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200010917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure.nearplatform.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200010918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure.oldschool.com-ee.cz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure.oldschool.com-rs.cz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure.oldschool.com-v.cz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure.runescope.com-as.cz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure.staman.direct.quickconnect.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200010923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secure55.webhostinghub.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"secureaccounthelpdesk.aitoloakarnanianews.gr"; content:"Host"; http_header; classtype:attempted-recon; sid:200010925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"securecuserver.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200010926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"securedocs-office365-onmicro000.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"securedwells27271.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200010928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"securegateway-ovhcloud.csl-sl.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200010929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"securewells.artale.co.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200010930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"security-page-community-standards.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"securityexit.260mb.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200010932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seebonerp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seehere.trainercentral.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"segubisa.0hi.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200010935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seguroitservices.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seguronacionalcr.ultimatefreehost.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200010937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seguropagoapp.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200010938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seillait.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sejsloao6181.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"select-a-cleaner.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"selfloving1234.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sellyi.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"semanario7dias.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sendermailers10.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sendermailers11.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sendermailers14.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sendermailers15.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sendermailers15.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sendermailers16.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sendermailers17.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sendermailers18.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sendermailers2.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sendermailers20.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sendermailers21.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sendermailers22.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sendermailers24.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sendermailers25.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sendermailers26.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sendermailers27.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sendermailers29.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sendermailers29.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sendermailers31.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sendermailers32.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sendermailers32.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sendermailers33.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sendermailers34.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sendermailers36.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sendermailers37.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sendermailers42.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sendermailers44.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sendermailers45.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sendermailers47.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sendermailers9.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sensdapps.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sensdapps.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seoservicesiox.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seri-lapot-mail.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sertyxese.myfreesites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200010979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"serv0spk.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200010980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"server-20-credem.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"server-networksolutions.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200010982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servertechnicalnoticeimmestae-reconecting.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200010983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servic-4096.awuqohsjo9847.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200010984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"service-homegate-wichtigzugangsdaten-konto.wpdevcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"service-lapostenet.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"service-lkdn2020.gacconstrutora.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200010987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"service-pudvuewnet01.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"serviceid-jaacsca1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"serviceid-jaacscaa1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servicepage.service-page.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200010991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"services-lnfoguide.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200010992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"services.mkbnetbankar.hu.mkkb.cloudns.ph"; content:"Host"; http_header; classtype:attempted-recon; sid:200010993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"services.oldschool.com-as.cz"; content:"Host"; http_header; classtype:attempted-recon; sid:200010994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servicesbancaire.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servicetracking-package.awlaadelkhouly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servicomconstrucciones.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servics.validationsecuradm.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200010998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"servisaludec.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200010999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"serviziompsienastorno.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"settingspananageneral.c1.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"setup-src-com.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"setupmynorton.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200011003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"seul.unilurio.ac.mz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sewcrazybecky.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfbtbtbtbt.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfc.com.vn"; content:"Host"; http_header; classtype:attempted-recon; sid:200011007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfcnbfg.ilo9s3.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200011008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfllp-shared-outl00k-folder.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfr-mesfactures.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfrpanel.lws.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200011011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sfxsdf.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sgtbalde991-dot-still-dynamics-321006.ue.r.appspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sh3612211.c.had.su"; content:"Host"; http_header; classtype:attempted-recon; sid:200011014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sh3648164.c.had.su"; content:"Host"; http_header; classtype:attempted-recon; sid:200011015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shahjeepsh.com.pk"; content:"Host"; http_header; classtype:attempted-recon; sid:200011016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shakeel.ae"; content:"Host"; http_header; classtype:attempted-recon; sid:200011017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shanky0.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200011018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"share-file-drive-device-local-disk.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"share-file-drive-device-local-disk.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"share-file-login-pdf.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"share-file-login-pdf.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"share.ebforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shared-cloud-project.reading-voicee.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shared-email-files.documents-project.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shared-files.dhaafand.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shared-folder-private.nhilenhil.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shared-private.files-auuth.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shared-private.voicee-security.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shared.0294823229453195849205827592018491.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shared.privatte-document.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sharedata-outl00k-folders.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shareddata-storage-0utl00k-01.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sharedfax815201376.wordpress.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sharedfiles.officesharedfile5be386971041e60c041f4217230df1b2.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sharedonline.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sharepoint.sharedfileonline.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sharepoint.timelessincome.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sharepointdocsecure.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shark-app-pd964.ondigitalocean.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shaza6259.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200011041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sheet.invoice-remit-advance.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shelllatampassargentina.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sheseemscool.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shfengineeringltd.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shikigai.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shikimei.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200011047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shinofreun.temp.swtest.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200011048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shiny-sound-a24a.rcvrysrvce.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shipment-post-at.apolline-voyance.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shop.berning-fitness.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200011051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shop.cmfurnituremall.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shopeecoins.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shopeeday2022.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shopfirnaces.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shopfrontservices.coffeecup.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shoppearlsandprosecco.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shopping-misstore.jp.login.wp857.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200011058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"short.mypaste.fun"; content:"Host"; http_header; classtype:attempted-recon; sid:200011059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"short.upm.es"; content:"Host"; http_header; classtype:attempted-recon; sid:200011060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shortconfirm-upmtdate.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shorturl-ddc.moph.go.th"; content:"Host"; http_header; classtype:attempted-recon; sid:200011062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shorturl.ac"; content:"Host"; http_header; classtype:attempted-recon; sid:200011063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shorturl.vn"; content:"Host"; http_header; classtype:attempted-recon; sid:200011064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shrill.nxazenom.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shutterislandsid2.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shutterislandsid4.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"shvas.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200011068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"si-tpp.dkp.jatimprov.go.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200011069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"siapujian.salatiga.go.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200011070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"siaweb.com.py"; content:"Host"; http_header; classtype:attempted-recon; sid:200011071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sid-anmnooann.beauty"; content:"Host"; http_header; classtype:attempted-recon; sid:200011072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sign-in-info.aeonco1.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sign-in-info.aeonco2.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sign-in-info.aeonco4.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sign-in-info.aeonco5.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sign-in-info.osteoism.aeonco10.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sign-in-info.osteoism.aeonco71.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sign-in-info.osteoism.aeonco72.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sign-in-info.osteoism.aeonco73.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sign-in-info.osteoism.aeonco75.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sign-in-info.osteoism.aeonco76.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sign-in-info.osteoism.aeonco77.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sign-in-info.osteoism.aeonco78.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sign-in-verification-929bb.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"signedlines.wavoto.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"signinattcom-107037.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200011087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sigulemada.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"siimploi-site.preview-domain.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"silent-firefly-5561.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200011090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"silent-snowflake-0170.signeddocs.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"siliconescuritiba.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200011092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"simgeprek.blitarkota.go.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200011093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"simplissimot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"simplybeyoutiful.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"simranarts.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sindemail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"siporados15585.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"siskj26nyxmwj0rzxghblkbbgivd2l.qwo231sdx.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200011099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sistemel.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"site-4403463-3995-6112.mystrikingly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"site.dappfixedconnect.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"site9423623.92.webydo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"site9434107.92.webydo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"site9548676.92.webydo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"site9552191.92.webydo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"site9606042.92.webydo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"site9607677.92.webydo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"site9608556.92.webydo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder157806.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder159641.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder162459.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder165745.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder167178.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder170515.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder170603.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder170875.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder171156.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sitebuilder171220.dynadot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"situspemulihanfacebook2.webnode.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200011120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sjnvd.yx8868.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200011121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"skinbid.biz.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200011122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"skinbid.org.es"; content:"Host"; http_header; classtype:attempted-recon; sid:200011123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"skipthaganes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"skiqthegames.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sklepkody.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200011126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sky-authenticate.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sky-authenticate.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"skyblueenterprises.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200011129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sl18839399.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"slaraltas.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"slasher.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200011132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sleamcommnunity.net.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200011133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sleepmaskz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sleimangroupco.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"slmkufeckf.jon-jensen.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"slowlinebag.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200011137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sm777.csb.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smal.lu"; content:"Host"; http_header; classtype:attempted-recon; sid:200011139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"small-dust-6c63.pontufbksd.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smartchaindefi.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smartcontractexecutor.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smartechapps.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smartmom.com.bd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smartsyncronization.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smbc-cn.gq"; content:"Host"; http_header; classtype:attempted-recon; sid:200011146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smbc-mc.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200011147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smbc-vpases.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200011148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smbc-vpasse.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200011149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smcb-ccamd.4-4-j-xcs4.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smcb-ccamd.5634633.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smcb-ccamd.76-u-gbf8.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smcb-ccamd.76-u-zxcv.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smcb-ccamd.eoewz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smcb-ccamd.ronzm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smcb-ccamd.vxaet.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smcb-ccamd.zanms.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smepp.uninp.edu.rs"; content:"Host"; http_header; classtype:attempted-recon; sid:200011158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smgolamalif.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200011159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smi.onlygfpics.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smkkesehatanjember.sch.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200011161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sml1s.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smll.sh"; content:"Host"; http_header; classtype:attempted-recon; sid:200011163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smmtbunknown.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smsenligne.myfreesites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smsmms.flazio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smsorangephonemail.myfreesites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smsorangesmsmessage.myfreesites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"smsverificationmms.myfreesites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sn-066660.ultimatefreehost.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200011170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sn-28273739.ihostfull.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sn0010192920.byethost5.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sn01002900.byethost5.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sn28393030.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sn91892939.byethost15.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"snbcvertess.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"snbcvertess.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"snetupdate73.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"snn919200390.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"snowy-brook-6802.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200011180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"snowy-sun-5b1e.tobyshan.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"snowy-viol.topijerami.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"snt-manometr.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200011183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sobresercorpo.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200011184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"soccertickets.ca"; content:"Host"; http_header; classtype:attempted-recon; sid:200011185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"socialnear.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"soemb-sacmd.4-4-j-lop9.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"soemb-sacmd.76-u-rvc3.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"soemb-sacmd.76-u-zxcv.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"soemb-sacmd.oueoa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"soemb-sacmd.rnonv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"soemb-sacmd.vaswa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"soemb-sacmd.xsczs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sofe-firma.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"soft-cell-8148.updateloginprogram.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"soft-paper-3207.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200011196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sol-community.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solana-btc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solana-great.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solana-gt.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solanaart.su"; content:"Host"; http_header; classtype:attempted-recon; sid:200011201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solanachief.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solanadrop.one"; content:"Host"; http_header; classtype:attempted-recon; sid:200011203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solanaforfree.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solanahackerhouse.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solanalite.website"; content:"Host"; http_header; classtype:attempted-recon; sid:200011206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solanascan.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200011207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solanascan.su"; content:"Host"; http_header; classtype:attempted-recon; sid:200011208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solanatimes.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200011209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solanaverse.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200011210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solardoqueijo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"soleilinc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solicitudprestamoalinstante-lbkperu.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solitar.tempetahu.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solscan.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200011215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solucao-para-todos.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solucaodigital-online.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solucaodigitalmaio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"soluciofa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solucionesach.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"solucoes-para-nos.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"somethingmoreconference.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sopac.org.py"; content:"Host"; http_header; classtype:attempted-recon; sid:200011223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sophiecordier.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200011224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sotellmepodcast.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200011225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"soteriacrystals.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200011226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"souaxwaoh.myfreesites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"soufsont.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"soulbound.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"soumya252000.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200011230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"southamerica-east1-clean-algebra-356021.cloudfunctions.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"southamerica-east1-hardy-magpie-334101.cloudfunctions.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"southamerica-east1-my-project-90086352.cloudfunctions.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"southamerica-east1-noted-minutia-330211.cloudfunctions.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sp477389.sitebeat.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200011235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spaceforyou.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200011236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spark.shaheenwrites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-it-center.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-itcenter.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kunden-abgleich.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kunden-abgleichung.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kunden-abruf.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kunden-abteilung.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kunden-anfrage.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kunden-center.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-kundenanfrage.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-ssl-login.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparka-stressfrei-verifizieren.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparkase-einloggen.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparkase-hauptmenu.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparkasse-haspa.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200011251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparkasse-proton.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200011252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparkasse-update.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200011253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparkasse.allgemeine-geschaeftsbedinungen.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200011254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparkasse.de-server1.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparkasse.de-server12.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200011256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparkasse.de-server4.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200011257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparkasse.de-server8.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200011258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparkassen-agb.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200011259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparkling-bar-cbbd.onedriveonline1617.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparkling-glitter-159f.scrtygdjahg.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparkling-snow-d1b6.bluebemaseddsd.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sparxinteriors.co.zw"; content:"Host"; http_header; classtype:attempted-recon; sid:200011263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spemail5.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200011264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spherefiinance.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spille.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200011266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spirecg.corsetul-boston.ro"; content:"Host"; http_header; classtype:attempted-recon; sid:200011267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spirit.gtwozone.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spiritswap-gow.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spjbusiness.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spk-abgleichung.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spk-einfach-verifizieren.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spk-finance-center.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spk-it-beratung.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spk-itcenter.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spk-kunden-abgleichung.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spk-kunden-sicher-verifizieren.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spk-kunden-verifikation.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spk-sichere-verifikation.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spk.customde-supported24.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200011280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spk.germande-services.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200011281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spk.languagede-gercustom.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200011282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spk.support24de-language.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200011283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spkde-srv01.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200011284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"splinditdrivingschool.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spmldf.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sport.protected-secur.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sportsbrooks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sprechls.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"spring-hat-3947.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200011290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"springsautoalpina.co.za"; content:"Host"; http_header; classtype:attempted-recon; sid:200011291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sprtrcvry.cnfrmacn.scrthlp.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sprw.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200011293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sqkufy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"srchrank.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"srvde-lnfoservice.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200011296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ssenclave.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sso-garena.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ssowebsrr435546.srvrwwalker.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stage-upgrade.nycgo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stage.donq.co.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200011301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"staging-app.1inch.io.s3-website-us-west-1.amazonaws.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"staging.aisecureme.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"staging.egfwd.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"staging.eliteautomotive.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200011305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"staging.threatspotter.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"staman.synology.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200011307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"staple-online.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"staratlas.co.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200011309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"staratlas.os.com.tr"; content:"Host"; http_header; classtype:attempted-recon; sid:200011310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"starliker.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"starlinginvestments.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"starsoftheindustry.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"starttsboxfile.myfreesites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"statbeyond.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"static-aolanmamloo1.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"static-promote.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"statisticssuccessheroes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"status-wallets.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"staved.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200011320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stclarechurch.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"steamcommnunnity.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"steamcommunlty.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200011323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"steamcommuntity.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200011324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"steamcommunutiy.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200011325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"steamcumnunity.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stearncommutity.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"steep-voice-9ec5.greenport.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"steep.bengkakbibirkuuu.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"steep.kacangrecinonfirem.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stepapp-minting.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stephaniesmythe.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stepn.re"; content:"Host"; http_header; classtype:attempted-recon; sid:200011333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stepndrop.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200011334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"steris.cloud"; content:"Host"; http_header; classtype:attempted-recon; sid:200011335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stevemaddencanadashoes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stevemaddennetherlands.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stevemaddenshoe.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stevencrews.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"still-credit-3583.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200011340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"still-dust-dc1f.dumpcloud542.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stolizaparketa.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200011342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stonextrade.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storage.yandexcloud.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storageapi-stg.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200011345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"storenike365.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stornompsiena.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200011347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"strikeitalia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"strugglestokids.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sttaratlas.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stty.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"studio-lol.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"studiodesignism.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stupefied-mestorf.153-92-223-212.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200011354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stuye3890.byethost6.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"stylifehomedecors.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"suas-solucoes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"subsidyandloan.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sucsoi-one.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sucursal29854888.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200011360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sucursalpersonastransaccionescolombia.faraexplozie.ro"; content:"Host"; http_header; classtype:attempted-recon; sid:200011361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"suelunn.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"suitou.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200011363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"suiviticket.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200011364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sukubotak67.tech"; content:"Host"; http_header; classtype:attempted-recon; sid:200011365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sulbrasildistribuidora.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200011366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sultan-raza.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200011367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sumary.repport-fb.accts-protocol.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"summary-fb.report-accts-notification.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"summary-protocol.report-accts-notification.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"summer-frost-9891.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200011371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sunim.xcwzrmv.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200011372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sunloverstudio.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200011373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sunnylandingpages.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sunply.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200011375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"supe.seharusnyakita.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"super-magalu.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"supernovainfo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"supervillesacces.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"suportepjcef.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"supp0rt-ovh.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"support-center-446071622.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200011382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"support-dapps.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200011383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"support-regions.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200011384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"support.att0n1ine.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"support24de-language.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200011386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sur3cr.csb.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"surahapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"surveyol.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swaggerhub-noprod.mibanco.com.pe"; content:"Host"; http_header; classtype:attempted-recon; sid:200011390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swanholm.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swap-bsc.tokentool.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200011392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swappauto.staging.lcsolutions.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200011393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swaptokenn.agency"; content:"Host"; http_header; classtype:attempted-recon; sid:200011394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swapuni.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swbellupdate73.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sweet-efax7656554545-aebf.82929222-happygringo.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sweet-sound-ba1a.sharepointonline-live2248.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sweetooth.wl-now.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swiftstation.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swipeindustry.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swisscom.myfreesites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"swisscomch.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"switstart.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"switzapps.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"switzerlandcom.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sxb1plvwcpnl492625.prod.sxb1.secureserver.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sxmartdohot.jelastic.regruhosting.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200011408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"syatwea.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"syclone.no"; content:"Host"; http_header; classtype:attempted-recon; sid:200011410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sydailand.buzz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sydenhampharma.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sygeforsikring.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sygeforsikring.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"symabeautyoriginal.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"synaxisreadymix.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sync-debug.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sync-integration.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"syncdappconnect.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"syracuseinfo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sys-postban-k.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200011421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"systematicrectifier.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"systems-bjoska.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"systems-bjoska.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"sznl.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200011425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"szq.vashonlove.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"t-exponent.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"t2xmzm.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ta0sqz05o.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"taher-mohamed-ahmed-saad.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200011430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"taichungphoto.org.tw"; content:"Host"; http_header; classtype:attempted-recon; sid:200011431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"taizhongqj.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"taizhongwrj.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"takemetolerch.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"takesdrop.org.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200011435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"taleswetell.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200011436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"talktalkea.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tambunanajaa.martulangsore.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"taskmbox493.softr.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tb915hdh89.mfs.gg"; content:"Host"; http_header; classtype:attempted-recon; sid:200011440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tby.eb-sites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tcaconnect.ac-page.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tcoe.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200011443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tcoutboard.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tdsecurities.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tdsecurities.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"teamemc2.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"teamgoogle125590.psee.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200011448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"teamsmicrosoft.noreply00001110msn000101000.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tebapit.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tech1-inc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"techinedonline.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"technical-fitness.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"techority.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tecmachine.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200011455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tecnofronza.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200011456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tecnominproductos.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"teekitstorage.blob.core.windows.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tef.vashonlove.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tehacarrasa.topijerami.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"telhanorte-90.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tellmeliu.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200011462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"telstra-823a7434e49e.intercom-clicks.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"templat65sldh.myfreesites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"temporary-url.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tenkiothauail10.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tenkiothauail10.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tenkiothauail3.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tenkiothauail4.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tenkiothauail5.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tenkiothauail5.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tenkiothauail8.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tennisblueprint.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tepremiagrupoo.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200011474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"terdapacucon.tk"; content:"Host"; http_header; classtype:attempted-recon; sid:200011475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"teritysaccuhuntsindetitys.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200011476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"terjalapakkz.topijerami.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"terpelsicumple.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"terraphase-shareddrives-0utl00k.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"test.gogodimsum.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"test.karnerta.at"; content:"Host"; http_header; classtype:attempted-recon; sid:200011481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"test.staypoland.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"test.webclient4.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200011483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"testingmir.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200011484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"texasfreedomrun.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tg.pe"; content:"Host"; http_header; classtype:attempted-recon; sid:200011486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tg0c4r4p3an6fj1nhu6oa6fb95d57kruqle7v2fdefe779r02n8f840.siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tgb64-ciaaa-aaaad-qc3ga-cai.ic.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200011488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tgdscx.fjazmcy.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200011489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tgfbvc.hoqkjzl.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200011490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tgfdr.azuvnlv.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200011491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thai-smartgrid.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thamelboutiquehotels.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"the-arenaa.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thebeachleague.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"theblueone1.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thecheesecakerylv.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thecoastmotel.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200011498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thecrytpchain.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thedefiantsnft.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thefolksco.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thefoodmantra.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200011502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thehumaniod.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"theironinnparlour.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200011504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"themarketprof.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"themelbournenutritionist.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thenynick.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"therothschildsdynasty.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200011508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"theroyalbharti.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thesaudisnft.premint.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200011510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thesosapparel.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"theupdatedlifestyle.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thewebrestore.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thfdb.hfcenbh.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200011514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thien0507.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200011515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thongtacconghanoi.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thrbcv.tqt5wqf.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200011517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"three-retail-live.devicetradein.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200011518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"throbbing-wildflower-4625.roundcubeupdateq.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"thryvwithkelly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tianlingdaochang.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tiekandhehayua11.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tiekandhehayua12.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tiekandhehayua2.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tiekandhehayua3.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tiekandhehayua3.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tiekandhehayua4.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tiekandhehayua5.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tight-sky-8967.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200011529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tilskud-danmark.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tilskud-danmark.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"timex-aus.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tiny-resonance-33c3.ianjeff5421794.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tiny-unit-6388.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200011534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tipografieonline.ro"; content:"Host"; http_header; classtype:attempted-recon; sid:200011535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"titanic.fareshopping.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200011536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tkinfo07.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tlatx.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tlecorp03802.fra1.digitaloceanspaces.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tlf.vashonlove.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"to-ken.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tocacheexpress.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"todayinboax.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"toddler-town.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tokoakriliktm.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tolgakarakas.com.tr"; content:"Host"; http_header; classtype:attempted-recon; sid:200011546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tolmedicalusa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"toltifotru.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tomcread98.neocities.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"top10songsnews.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"topdesignerhandbags.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"topearnersafrica.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"topgradespices.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200011553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"topskills.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200011554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"topstocksolutions.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"torccolborrachas.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"touch-media.ro"; content:"Host"; http_header; classtype:attempted-recon; sid:200011557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"toursexplorer.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"track-id4190.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"track-id4190.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trackerc.osend.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200011561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trackgroups.unaux.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tracking-auspost.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tracking.flowii.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trade-iq-option-2021.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trader.uniocean.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tradesetup.co.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200011567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tradex-premium.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tradingbbex.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"traineesupltd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"training.centremsf.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trams.mot.go.th"; content:"Host"; http_header; classtype:attempted-recon; sid:200011572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"transcend.ae"; content:"Host"; http_header; classtype:attempted-recon; sid:200011573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"transcendslimitations.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200011574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"transexual-gif-springer-insights.trycloudflare.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"transfer-wisea.app.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200011576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"transferwallet.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200011577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"travelmyroutes.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"travelvisit-mexico.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tree-bedecked-dress.glitch.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200011580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"treex.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200011581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trgracecompany.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trhbvc.fdpnnnw.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200011583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tribelio.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200011584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"triborofusion.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tribunbalikpapan.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tronwallet.com.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200011587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trustpad-ether.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trustpadclaim.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trustwallettop.easy.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200011590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trya673434.260mb.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"trytoshop.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ts.my"; content:"Host"; http_header; classtype:attempted-recon; sid:200011593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ts3.sudaqe.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ts3card.ayxdew.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ts3card.com.ylpklx.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ts3card.rmotwuh.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200011597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tscard3.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tscmedia.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200011599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ttatithorritati.podcastheritage.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200011600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ttgdgdgyahiooo.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tugasrekomendasiwisata.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tugcecolakbeauty.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuiaazul.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200011604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tumurt-urguu.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecaptcha10.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200011606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecaptcha12.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200011607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecaptcha13.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200011608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecaptcha16.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200011609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecaptcha17.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200011610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecaptcha18.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200011611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecaptcha2.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200011612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecaptcha5.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200011613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tunecaptcha7.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200011614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuqya1616taa.unaux.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuscantravel.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuspromociones2022.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tutor.iqsademo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuyainiciarcarlo.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200011619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuyaritagua.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200011620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuyarvadsghdfdg.great-site.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tuyatargetone.ihostfull.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tvfsv.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200011623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"twafgig.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200011624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"twentyonelifestyle.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"twibhokiandgraiyakischools.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"twilig.semangatpuasaaa.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"twilight.recomfiermsite.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"twilio.oktaservice.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"twowestadvisors-shareddrives-0utl00k.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tyaprtlahsbj.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200011631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"tyrurhrrhbh.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"u-bolt.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200011633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"u14511627.ct.sendgrid.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"u1737600.plsk.regruhosting.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200011635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"u1738401.plsk.regruhosting.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200011636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"u1740440.plsk.regruhosting.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200011637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"u18741649.ct.sendgrid.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"u3vii.codesandbox.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200011639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uat-new.wcv.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uc-new-midasbuy.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ucbonline.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uconn-edu-online.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"udbetaling-sygeforsikring.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ue7yyedec7a8lowmfwl.qwo231sdx.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200011645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uftgcv.bsvxoje.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200011646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uftoken.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ugyftdraq.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200011648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uisbricarw.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ujtfbv.khkkuuz.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200011650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ujtyvb.eiozpzq.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200011651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ujycx.gakklqs.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200011652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uk-dpd.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ukd6s.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ukraineconsulatelib.azurewebsites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ukrt1s.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ukygfv.hmlljw.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200011657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ultimateperfection04.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ume.la"; content:"Host"; http_header; classtype:attempted-recon; sid:200011659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"umu.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200011660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unam.myfreesites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unbossed.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"underview-account-id100784668.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uneedparts.ca"; content:"Host"; http_header; classtype:attempted-recon; sid:200011664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unfinishedwellmadetrialsoftware.sagedental.repl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200011665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uni-swap.coinpocket.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200011666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uniassessoria.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200011667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unicreditaustria.ucs.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200011668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unioncredidesarrollo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unionheightsresidental.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unisons.store"; content:"Host"; http_header; classtype:attempted-recon; sid:200011671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unisonsouthayr.org.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200011672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uniswap-exchanges.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uniswap-pos.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200011674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uniswap-pos.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uniswap-web3.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uniswap.ch"; content:"Host"; http_header; classtype:attempted-recon; sid:200011677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uniswap.openwallet.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uniswap.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uniswap.token.im"; content:"Host"; http_header; classtype:attempted-recon; sid:200011680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uniswap.umidao.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uniswap.v2.testnet.pulsechain.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uniswapfinancing.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200011683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uniswaplp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unitedsolutions.pk"; content:"Host"; http_header; classtype:attempted-recon; sid:200011685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"universal-sweltering-sleet.glitch.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200011686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unixxgen.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unojapano.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"unsub.listhandlr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uotaewsrcsetiyssidentytys.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200011690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"upbearin.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"upbeat-dubinsky.62-210-144-230.plesk.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200011692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"upcday.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"updat3s.atts3rvices.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"update-dbs.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"update-doc.list-project-shared.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"update-netprofile.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"update.attservice.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"update.com.brandonanything.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"updateaddress-ups.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"updatecenter01378.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"updatecenter013780ba.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"updatescseritysacoountss.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200011703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"updateseccytsideitytytss.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200011704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"updatess.cfzijxcsp.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"updatevoda-billing.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"upgradepage.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200011707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ups-clientupdate.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"upsiteconsulting.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uqclpg.webwave.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uri.im"; content:"Host"; http_header; classtype:attempted-recon; sid:200011711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"url.fti.or.th"; content:"Host"; http_header; classtype:attempted-recon; sid:200011712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"url.xcode.no"; content:"Host"; http_header; classtype:attempted-recon; sid:200011713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"urli.ws"; content:"Host"; http_header; classtype:attempted-recon; sid:200011714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"urlly.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200011715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"urnic.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"us-brooksrun.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"us-central1-x-descent-340319.cloudfunctions.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"us-east1-x-descent-340319.cloudfunctions.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"us-postal-service-re-delivery-package.builderallwppro.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"us-postal-tracking-service-online.builderallwppro.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"us-postalservicestracking.builderallwppro.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"us-west4-mercurial-idiom-334123.cloudfunctions.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"usa-uksp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"usaaxcfvytfvyfy.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"usarestaurantsuppliers.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"usdc-trx.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"usdt-finance.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200011728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"usdt-pos.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"used-jaccs--jp-login1.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"used-my-connect-au-login6.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"usedtextilemachinery4sale.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"user-olivierclemot.flazio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"user-security.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"user.peppiandco.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200011735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"userboitevocalweb.flazio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"userinformationstoreupdatesmail.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"users.tpg.com.au"; content:"Host"; http_header; classtype:attempted-recon; sid:200011738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"usfn.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"usp-adinmos.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200011740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"usp-secure-update.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uspps-b60cf4.ingress-comporellon.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200011742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"usps-tracking.hectorcalle.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uspsecureparcel.wonstasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uv09s6357.riggearf.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uverdnes.cz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uxkky38iut9586a.qwo231sdx.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200011747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uxs8ti.csb.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uyhkd.hwpfwhv.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200011749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"uyng.j76bukv.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200011750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"v-verify-pembatalan-pemblokiran.webnode.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200011751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"v11nteed-page.494765.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"v3r1f1c4t10n-s1t34pp.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"valarqss.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"valenciaoptometry.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"valiahorat.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200011756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"validacionpichincha.odoo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"validate-wallet.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200011758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"validatesecurredwallets.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"validatetok.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"validatewalletconnect.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"validationportal.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"valkonp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vallianiaerodetail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"valobom.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"valueded.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vc-107510.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vcnbwoilrehfvg-3wre8igfvh-werpivhbgwe3rv-wer.obs.la-south-2.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vdsbf.fjnvfyh.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200011769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vdsbfg.alpprgy.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200011770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vdxcs.vgqdztr.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200011771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veefriends-nft-giveaway.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veefriends-nft-giveaway.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veeraja.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vektrofoods.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vented-pl.order-umowa429038.beauty"; content:"Host"; http_header; classtype:attempted-recon; sid:200011776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ver-2ji.pages.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veragol.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200011778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veranope.wwwaz1-ss44.a2hosted.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veraodeoportunidades.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veredicto63.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200011781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veri-conns-site.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verificador-credito.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verificador-credito.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verificador-cupo.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verificador-cupo.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verificar-cuenta-12345.click"; content:"Host"; http_header; classtype:attempted-recon; sid:200011787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verification-redirection.s3.eu-west-2.amazonaws.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verification-roundcube.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verification-roundcube.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verification.fb-page.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200011791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verificationmessage.blob.core.windows.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verificationmetamask.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verifikasi-akun-anda0011.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verifikasi-akun-facebook0022.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verifikasi-pengamanan-akun.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verify-apple-pay.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"verifychekchekyahooatt.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"veriifikasiakun.wixsite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"versanddienstleister-info.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vertexengineering.com.pk"; content:"Host"; http_header; classtype:attempted-recon; sid:200011801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vetrilsoftware.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vfhne403rhi89-vgie3hbn-r5hvbg-ehvbr-e9rh54-vrgr.obs.ap-southeast-3.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vfnh3wo0i4er8gfv0-3ihbn4-0rgbfnh-03w4b.obs.la-south-2.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vfnxdygysu.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200011805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vibramwyprzedaz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vicblock.co.ke"; content:"Host"; http_header; classtype:attempted-recon; sid:200011807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"victorarath99.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200011808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieal.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vieirasadvogados.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vietgahp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viettel-com-dot-c2c01-531c7.uc.r.appspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"view-folder-share-doc-file.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"view-folder-share-doc-file.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"view-folder-share-doc-logistic.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"view-folder-share-doc-logistic.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"view-share-folder-file.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"view-share-folder-file.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"view-shared-file-folder-login.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"view-shared-file-folder-login.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200011820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viewingonlinepdf.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viewlocation.info"; content:"Host"; http_header; classtype:attempted-recon; sid:200011822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viewthescreen.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vihted-pl.dostawa-id523790.beauty"; content:"Host"; http_header; classtype:attempted-recon; sid:200011824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vihted-pl.dostawa93034.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vihted-pl.id-dostawa490237.buzz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vihted-pl.id-dostawa972834.click"; content:"Host"; http_header; classtype:attempted-recon; sid:200011827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vimte-d465dellvery.632003.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinosdev.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted.cash"; content:"Host"; http_header; classtype:attempted-recon; sid:200011830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vinted.order-9018237.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200011831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"violetkingauthor.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vipfbtools.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viplayer.es"; content:"Host"; http_header; classtype:attempted-recon; sid:200011834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"virtual.labdigbdbqapb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"virtual.labdigbdbstgpb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"virutca.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vis-stort.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200011838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visac.co-jp-viscsvisesvas.dhbzqdj.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200011839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visac.co-jp-viscsvisesvas.temduna.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200011840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visac.co-jp-viscsvisesvas.tigafcj.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200011841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visac.co-jp-viscsvisesvas.ynnwfwh.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200011842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visac.co-jp-viscsvisesvas.zxwzgjv.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200011843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visac.co-jp-viscsvisevas.norfccg.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200011844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaceoan-vvsasoensi.rwmcr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaceoan-vvsasoensi.wiguyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaceoan-vvsasoensi.wozavw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaceoan-vvsasoensi.xfertf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaceoan-vvsasoensi.xovtfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaceoan-vvsasoensi.xvljph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaceoan-vvsasoensi.xvotal.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaceoan-vvsasoensi.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaceoan-vvsasoensi.ydpssl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaceoan-vvsasoensi.yfnvfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaceoan-vvsasoensi.ytbspo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaceoan-vvsasoensi.yyyuwr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaceoan-vvsasoensi.zohlkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaceoan-vvsasoensi.zpirok.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visaceoan-vvsasoensi.zusrue.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visagesystems.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visanew.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200011861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visao.co-jp-visacsovisea.noycdzz.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200011862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visao.co-jp-visacsovisea.nssfzvg.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200011863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visao.co-jp-visacsovisea.qyfiqci.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200011864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visao.co-jp-visacsovissea.bhgyxss.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200011865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visao.co-jp-visacsovissea.nnlkjky.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200011866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visao.co-jp-visacsovissea.obfbhpu.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200011867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visao.co-jp-visacsovissea.xzorqie.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200011868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visao.co-jp-visacsovissea.ynnwfwh.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200011869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecacsvsie.viseacasvsie.saahbij.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200011870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoceacasvsie.1235439.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoceacasvsie.1354387.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoceacasvsie.2558878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoceacasvsie.3838833.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoceacasvsie.4535888.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoceacasvsie.6687784.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoceacasvsie.6786787.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoceacasvsie.6997854.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoceacasvsie.6997887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoceacasvsie.9697555.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoceacasvsie.aiex.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoceacasvsie.axs.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200011882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoceacasvsie.bchain.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200011883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoceacasvsie.bitpay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoceacasvsie.cehua.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoceacasvsie.coinbig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoceacasvsie.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoceacasvsie.dingzhi.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoceacasvsie.diot.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoceacasvsie.djkskoc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200011890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoceacasvsie.eefi.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200011891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoceacasvsie.jiami.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoceacasvsie.junhan.wang"; content:"Host"; http_header; classtype:attempted-recon; sid:200011893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoceacasvsie.nftcn.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoceacasvsie.particularly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200011895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoceacasvsie.pinggu.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoceacasvsie.platon.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200011897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoceacasvsie.rolling41.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoceacasvsie.sbfaka.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoceacasvsie.shangpin.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoceacasvsie.suifeng.asia"; content:"Host"; http_header; classtype:attempted-recon; sid:200011901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoceacasvsie.uvwxyz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200011902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoceacasvsie.wangcaitongbao6.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoceacasvsie.wangcaitongbao7.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoceacasvsie.wechain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoceacasvsie.wiot.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoceacasvsie.yingjikuaijie1.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoceacasvsie.yingjikuaijie2.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoceacasvsie.yingjikuaijie3.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoceacasvsie.yingjikuaijie4.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoceacasvsie.yingjiyoupin6.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoceacasvsie.yingjiyoupin8.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoceacasvsie.yxfspd.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoeacasvsie.1235439.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoeacasvsie.1354387.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoeacasvsie.2558878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoeacasvsie.3838833.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoeacasvsie.4535888.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoeacasvsie.6687784.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoeacasvsie.6786787.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoeacasvsie.6997854.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoeacasvsie.6997887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoeacasvsie.9697555.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoeacasvsie.aiex.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoeacasvsie.axs.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200011925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoeacasvsie.bchain.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200011926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoeacasvsie.bitpay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoeacasvsie.cehua.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoeacasvsie.coinbig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoeacasvsie.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoeacasvsie.dingzhi.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoeacasvsie.diot.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoeacasvsie.djkskoc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200011933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoeacasvsie.eefi.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200011934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoeacasvsie.jiami.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoeacasvsie.junhan.wang"; content:"Host"; http_header; classtype:attempted-recon; sid:200011936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoeacasvsie.koplsia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200011937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoeacasvsie.nftcn.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoeacasvsie.pinggu.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoeacasvsie.platon.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200011940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoeacasvsie.rolling41.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoeacasvsie.sbfaka.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoeacasvsie.shangpin.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoeacasvsie.suifeng.asia"; content:"Host"; http_header; classtype:attempted-recon; sid:200011944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoeacasvsie.wangcaitongbao6.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoeacasvsie.wangcaitongbao7.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoeacasvsie.wechain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoeacasvsie.wiot.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoeacasvsie.yingjikuaijie1.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoeacasvsie.yingjikuaijie2.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoeacasvsie.yingjikuaijie3.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoeacasvsie.yingjikuaijie4.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoeacasvsie.yingjiyoupin6.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoeacasvsie.yingjiyoupin8.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasecsvsie.viscoeacasvsie.yxfspd.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecocasvsie.1235439.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecocasvsie.1354387.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecocasvsie.2558878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecocasvsie.3838833.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecocasvsie.4535888.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecocasvsie.6687784.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecocasvsie.6786787.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecocasvsie.6997854.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecocasvsie.6997887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecocasvsie.9697555.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecocasvsie.aiex.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecocasvsie.axs.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200011967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecocasvsie.bitpay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecocasvsie.cehua.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecocasvsie.coconaicha.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200011970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecocasvsie.coinbig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecocasvsie.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecocasvsie.dingzhi.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecocasvsie.diot.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecocasvsie.eefi.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200011975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecocasvsie.jiami.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecocasvsie.junhan.wang"; content:"Host"; http_header; classtype:attempted-recon; sid:200011977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecocasvsie.koplsia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200011978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecocasvsie.nftcn.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecocasvsie.particularly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200011980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecocasvsie.pinggu.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecocasvsie.platon.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200011982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecocasvsie.rolling41.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecocasvsie.sbfaka.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecocasvsie.shangpin.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200011985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecocasvsie.suifeng.asia"; content:"Host"; http_header; classtype:attempted-recon; sid:200011986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecocasvsie.uvwxyz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200011987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecocasvsie.wangcaitongbao6.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecocasvsie.wangcaitongbao7.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecocasvsie.wechain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecocasvsie.wiot.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200011991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecocasvsie.yingjikuaijie1.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecocasvsie.yingjikuaijie2.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecocasvsie.yingjikuaijie3.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecocasvsie.yingjikuaijie4.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecocasvsie.yingjiyoupin6.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecocasvsie.yingjiyoupin8.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200011997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecocasvsie.yxfspd.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecoccasvsie.1235439.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200011999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecoccasvsie.1354387.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecoccasvsie.2558878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecoccasvsie.3838833.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecoccasvsie.4535888.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecoccasvsie.6687784.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecoccasvsie.6786787.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecoccasvsie.6997854.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecoccasvsie.6997887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecoccasvsie.9697555.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecoccasvsie.aiex.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecoccasvsie.axs.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200012010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecoccasvsie.bchain.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200012011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecoccasvsie.bitpay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecoccasvsie.cehua.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200012013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecoccasvsie.coinbig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecoccasvsie.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecoccasvsie.dingzhi.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200012016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecoccasvsie.diot.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecoccasvsie.eefi.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200012018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecoccasvsie.jiami.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200012019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecoccasvsie.jshdiwje.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecoccasvsie.junhan.wang"; content:"Host"; http_header; classtype:attempted-recon; sid:200012021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecoccasvsie.nftcn.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecoccasvsie.pinggu.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200012023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecoccasvsie.platon.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200012024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecoccasvsie.rolling41.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecoccasvsie.sbfaka.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecoccasvsie.shangpin.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200012027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecoccasvsie.suifeng.asia"; content:"Host"; http_header; classtype:attempted-recon; sid:200012028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecoccasvsie.wangcaitongbao6.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecoccasvsie.wangcaitongbao7.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecoccasvsie.wechain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecoccasvsie.wiot.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecoccasvsie.yingjikuaijie1.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecoccasvsie.yingjikuaijie2.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecoccasvsie.yingjikuaijie3.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecoccasvsie.yingjikuaijie4.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecoccasvsie.yingjiyoupin6.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecoccasvsie.yingjiyoupin8.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasesvsie.visecoccasvsie.yxfspd.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasvsie.visecasvsie.mjtgocv.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200012040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasvsie.visecasvsie.omgsrcq.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200012041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasvsie.visecasvsie.wvqxbue.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200012042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasvsie.viseccasvsie.fezipzi.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200012043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasvsie.viseccasvsie.maktldq.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200012044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasvsie.viseccasvsie.saahbij.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200012045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasvsie.viseccasvsie.xonhdyj.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200012046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasvsie.viseccasvsie.yhareig.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200012047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecasvsie.viseccasvsie.zeybhmg.mobi.tt"; content:"Host"; http_header; classtype:attempted-recon; sid:200012048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.viscceacasvsie.1235439.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.viscceacasvsie.1354387.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.viscceacasvsie.2558878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.viscceacasvsie.3838833.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.viscceacasvsie.4535888.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.viscceacasvsie.6687784.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.viscceacasvsie.6786787.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.viscceacasvsie.6997854.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.viscceacasvsie.6997887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.viscceacasvsie.9697555.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.viscceacasvsie.aiex.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.viscceacasvsie.axs.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200012060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.viscceacasvsie.bchain.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200012061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.viscceacasvsie.bitpay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.viscceacasvsie.cehua.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200012063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.viscceacasvsie.coconaicha.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.viscceacasvsie.coinbig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.viscceacasvsie.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.viscceacasvsie.dingzhi.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200012067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.viscceacasvsie.diot.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.viscceacasvsie.eefi.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200012069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.viscceacasvsie.jiami.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200012070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.viscceacasvsie.jshdiwje.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.viscceacasvsie.junhan.wang"; content:"Host"; http_header; classtype:attempted-recon; sid:200012072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.viscceacasvsie.koplsia.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.viscceacasvsie.koplsib.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.viscceacasvsie.nftcn.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.viscceacasvsie.pinggu.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200012076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.viscceacasvsie.platon.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200012077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.viscceacasvsie.rolling41.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.viscceacasvsie.sbfaka.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.viscceacasvsie.shangpin.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200012080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.viscceacasvsie.suifeng.asia"; content:"Host"; http_header; classtype:attempted-recon; sid:200012081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.viscceacasvsie.wangcaitongbao6.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.viscceacasvsie.wangcaitongbao7.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.viscceacasvsie.wechain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.viscceacasvsie.wiot.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.viscceacasvsie.yingjikuaijie1.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.viscceacasvsie.yingjikuaijie2.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.viscceacasvsie.yingjikuaijie3.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.viscceacasvsie.yingjikuaijie4.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.viscceacasvsie.yingjiyoupin6.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.viscceacasvsie.yingjiyoupin8.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.viscceacasvsie.yxfspd.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.visceacasvsie.1235439.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.visceacasvsie.1354387.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.visceacasvsie.2558878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.visceacasvsie.3838833.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.visceacasvsie.4535888.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.visceacasvsie.6687784.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.visceacasvsie.6786787.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.visceacasvsie.6997854.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.visceacasvsie.6997887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.visceacasvsie.9697555.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.visceacasvsie.aiex.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.visceacasvsie.axs.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200012104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.visceacasvsie.bchain.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200012105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.visceacasvsie.bitpay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.visceacasvsie.cehua.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200012107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.visceacasvsie.coinbig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.visceacasvsie.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.visceacasvsie.dingzhi.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200012110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.visceacasvsie.diot.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.visceacasvsie.eefi.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200012112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.visceacasvsie.jiami.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200012113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.visceacasvsie.jshdiwje.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.visceacasvsie.junhan.wang"; content:"Host"; http_header; classtype:attempted-recon; sid:200012115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.visceacasvsie.koplsib.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.visceacasvsie.nftcn.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.visceacasvsie.pinggu.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200012118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.visceacasvsie.platon.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200012119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.visceacasvsie.rolling41.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.visceacasvsie.sbfaka.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.visceacasvsie.shangpin.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200012122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.visceacasvsie.suifeng.asia"; content:"Host"; http_header; classtype:attempted-recon; sid:200012123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.visceacasvsie.wangcaitongbao6.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.visceacasvsie.wangcaitongbao7.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.visceacasvsie.wechain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.visceacasvsie.wiot.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.visceacasvsie.yingjikuaijie1.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.visceacasvsie.yingjikuaijie2.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.visceacasvsie.yingjikuaijie3.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.visceacasvsie.yingjikuaijie4.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.visceacasvsie.yingjiyoupin6.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.visceacasvsie.yingjiyoupin8.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseacsvsie.visceacasvsie.yxfspd.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.viseccasvsie.1235439.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.viseccasvsie.1354387.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.viseccasvsie.2558878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.viseccasvsie.3838833.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.viseccasvsie.4535888.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.viseccasvsie.6687784.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.viseccasvsie.6786787.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.viseccasvsie.6997854.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.viseccasvsie.6997887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.viseccasvsie.9697555.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.viseccasvsie.aiex.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.viseccasvsie.bchain.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200012146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.viseccasvsie.bitpay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.viseccasvsie.cehua.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200012148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.viseccasvsie.coinbig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.viseccasvsie.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.viseccasvsie.dingzhi.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200012151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.viseccasvsie.diot.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.viseccasvsie.eefi.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200012153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.viseccasvsie.jiami.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200012154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.viseccasvsie.jshdiwje.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.viseccasvsie.junhan.wang"; content:"Host"; http_header; classtype:attempted-recon; sid:200012156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.viseccasvsie.koplsib.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.viseccasvsie.nftcn.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.viseccasvsie.particularly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.viseccasvsie.pinggu.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200012160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.viseccasvsie.platon.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200012161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.viseccasvsie.rolling41.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.viseccasvsie.sbfaka.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.viseccasvsie.shangpin.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200012164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.viseccasvsie.suifeng.asia"; content:"Host"; http_header; classtype:attempted-recon; sid:200012165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.viseccasvsie.wangcaitongbao6.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.viseccasvsie.wangcaitongbao7.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.viseccasvsie.wechain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.viseccasvsie.wiot.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.viseccasvsie.xiaomi8.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200012170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.viseccasvsie.yingjikuaijie1.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.viseccasvsie.yingjikuaijie2.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.viseccasvsie.yingjikuaijie3.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.viseccasvsie.yingjikuaijie4.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.viseccasvsie.yingjiyoupin6.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.viseccasvsie.yingjiyoupin8.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.viseccasvsie.yxfspd.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.visecccasvsie.1235439.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.visecccasvsie.1354387.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.visecccasvsie.2558878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.visecccasvsie.3838833.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.visecccasvsie.4535888.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.visecccasvsie.6687784.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.visecccasvsie.6786787.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.visecccasvsie.6997854.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.visecccasvsie.6997887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.visecccasvsie.9697555.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.visecccasvsie.aiex.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.visecccasvsie.axs.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200012189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.visecccasvsie.bchain.life"; content:"Host"; http_header; classtype:attempted-recon; sid:200012190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.visecccasvsie.bitpay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.visecccasvsie.cehua.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200012192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.visecccasvsie.coinbig.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.visecccasvsie.dchain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.visecccasvsie.dingzhi.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200012195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.visecccasvsie.diot.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.visecccasvsie.djkskoc.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.visecccasvsie.eefi.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200012198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.visecccasvsie.jiami.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200012199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.visecccasvsie.junhan.wang"; content:"Host"; http_header; classtype:attempted-recon; sid:200012200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.visecccasvsie.nftcn.biz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.visecccasvsie.particularly.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.visecccasvsie.pinggu.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200012203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.visecccasvsie.platon.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200012204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.visecccasvsie.rolling41.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.visecccasvsie.sbfaka.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.visecccasvsie.shangpin.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200012207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.visecccasvsie.suifeng.asia"; content:"Host"; http_header; classtype:attempted-recon; sid:200012208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.visecccasvsie.wangcaitongbao6.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.visecccasvsie.wangcaitongbao7.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.visecccasvsie.wechain.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.visecccasvsie.wiot.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.visecccasvsie.yingjikuaijie1.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.visecccasvsie.yingjikuaijie2.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.visecccasvsie.yingjikuaijie3.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.visecccasvsie.yingjikuaijie4.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.visecccasvsie.yingjiyoupin6.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.visecccasvsie.yingjiyoupin8.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200012218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visecseasvsie.visecccasvsie.yxfspd.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"viseoscai.vscsaeeicso.rxqvzx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visescai.vscsaeeiso.vtmcgz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visioncenterss.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visoascseosri-vassesvi.wiguyc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visoascseosri-vassesvi.wkbakq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visoascseosri-vassesvi.wozavw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visoascseosri-vassesvi.xvotal.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visoascseosri-vassesvi.xwitwq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visoascseosri-vassesvi.ybmkwa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visoascseosri-vassesvi.zohlkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissvvesie.vvssceoi.ablndk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissvvesie.vvssceoi.acucbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissvvesie.vvssceoi.aebyti.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissvvesie.vvssceoi.bdctxj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissvvesie.vvssceoi.cgamgq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissvvesie.vvssceoi.chgskm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissvvesie.vvssceoi.czexys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissvvesie.vvssceoi.dborfs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissvvesie.vvssceoi.dhvprp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissvvesie.vvssceoi.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissvvesie.vvssceoi.ejxxpq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissvvesie.vvssceoi.eonors.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissvvesie.vvssceoi.erxemo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissvvesie.vvssceoi.fokvsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissvvesie.vvssceoi.gqnrcz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissvvesie.vvssceoi.gxisfb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissvvesie.vvssceoi.hixcny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissvvesie.vvssceoi.hlnifq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissvvesie.vvssceoi.hrzgox.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissvvesie.vvssceoi.hxsyjk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissvvesie.vvssceoi.iicfis.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissvvesie.vvssceoi.jtaykj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissvvesie.vvssceoi.juocax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissvvesie.vvssceoi.kzadys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissvvesie.vvssceoi.lcjmil.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissvvesie.vvssceoi.lnkmoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissvvesie.vvssceoi.manljw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissvvesie.vvssceoi.nmlubc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissvvesie.vvssceoi.nsetef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissvvesie.vvssceoi.nytsha.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissvvesie.vvssceoi.oqgpdd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissvvesie.vvssceoi.ouomrg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissvvesie.vvssceoi.ovbfsv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissvvesie.vvssceoi.ozicyo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissvvesie.vvssceoi.pczkai.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissvvesie.vvssceoi.pdmvfc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissvvesie.vvssceoi.pwzivx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissvvesie.vvssceoi.rabbhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissvvesie.vvssceoi.wpoawh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissvvesie.vvssceoi.wwbmod.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissvvesie.vvssceoi.xjkfdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissvvesie.vvssceoi.xlftxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissvvesie.vvssceoi.xlokjz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissvvesie.vvssceoi.xvebfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissvvesie.vvssceoi.yaaabg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissvvesie.vvssceoi.zbqfwh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vissvvesie.vvssceoi.zhxqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvesvsaeci.visesevsae.mwoahw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvesvsaeci.visesevsae.nupxij.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvesvsaeci.visesevsae.ofojhi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvesvsaeci.visesevsae.oszusw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvesvsaeci.visesevsae.pekbwh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvesvsaeci.visesevsae.phwfmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvesvsaeci.visesevsae.rwtvts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvesvsaeci.visesevsae.tsmhjl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvesvsaeci.visesevsae.vlyvyk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvesvsaeci.visesevsae.vwczmd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvesvsascei.viessievcsaoe.moidld.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvesvsascei.viessievcsaoe.ofuhhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvesvsascei.viessievcsaoe.oszusw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvesvsascei.viessievcsaoe.oyvwhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvesvsascei.viessievcsaoe.pazooa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvesvsascei.viessievcsaoe.pcmubo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvesvsascei.viessievcsaoe.pfqmmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvesvsascei.viessievcsaoe.phwfmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvesvsascei.viessievcsaoe.prxtir.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvesvsascei.viessievcsaoe.pwgdsb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvesvsascei.viessievcsaoe.qaznqy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvesvsascei.viessievcsaoe.rjoxxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevsaei.visevsae.mpieoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevsaei.visevsae.pekbwh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevsaei.visevsae.pfqmmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevsaei.visevsae.phwfmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevsaei.visevsae.qaznqy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevsaei.visevsae.rpughy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevsaei.visevsae.rthqqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevsaei.visevsae.tzrwxh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevsaei.visevsae.vgftqx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevsasei.visievcsaoe.myeqsi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevsasei.visievcsaoe.ofuhhs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevsasei.visievcsaoe.oyvwhq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevsasei.visievcsaoe.pazooa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevsasei.visievcsaoe.pekbwh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevsasei.visievcsaoe.pexlcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevsasei.visievcsaoe.prxtir.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevsasei.visievcsaoe.pwgdsb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevsasei.visievcsaoe.qnilfr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevsasei.visievcsaoe.sqoocd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevsasei.visievcsaoe.swsaic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevsasei.visievcsaoe.uozagq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevsasei.visievcsaoe.vhyyuk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevsevsaei.visevsaeccase.mvjtfp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevsevsaei.visevsaeccase.ooybpr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevsevsaei.visevsaeccase.pazooa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevsevsaei.visevsaeccase.pexlcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevsevsaei.visevsaeccase.pfqmmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevsevsaei.visevsaeccase.prjsxv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevsevsaei.visevsaeccase.pwgdsb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevsevsaei.visevsaeccase.qzhrsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevsevsaei.visevsaeccase.slucdk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevsevsaei.visevsaeccase.tkzpfo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevsevsaei.visevsaeccase.vcygop.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevsevsaei.visevsaeccase.vhyyuk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevsevsaei.visevsaeccase.vwczmd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevsevsasei.visievcccasesaoe.nqtygh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevsevsasei.visievcccasesaoe.pcmubo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevsevsasei.visievcccasesaoe.pexlcg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevsevsasei.visievcccasesaoe.pfqmmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevsevsasei.visievcccasesaoe.phwfmr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"visvevsevsasei.visievcccasesaoe.slucdk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivinlt.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200012340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvseiv.vosoaseiv.ablndk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvseiv.vosoaseiv.acucbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvseiv.vosoaseiv.adqdwg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvseiv.vosoaseiv.avqtnx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvseiv.vosoaseiv.bsvdfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvseiv.vosoaseiv.cbmikk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvseiv.vosoaseiv.cormdp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvseiv.vosoaseiv.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvseiv.vosoaseiv.dcvcfq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvseiv.vosoaseiv.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvseiv.vosoaseiv.dfhxow.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvseiv.vosoaseiv.dqbskq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvseiv.vosoaseiv.dxjcrq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvseiv.vosoaseiv.ehbrwp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvseiv.vosoaseiv.ehsiyy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvseiv.vosoaseiv.erxemo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvseiv.vosoaseiv.espkgb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvseiv.vosoaseiv.fgopqn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvseiv.vosoaseiv.fhcljq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvseiv.vosoaseiv.fokvsf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvseiv.vosoaseiv.fxojqk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvseiv.vosoaseiv.govwoy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvseiv.vosoaseiv.gqnrcz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvseiv.vosoaseiv.gsajzb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvseiv.vosoaseiv.iwwocw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvseiv.vosoaseiv.jaovxc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvseiv.vosoaseiv.jaubvr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvseiv.vosoaseiv.jgahwi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvseiv.vosoaseiv.jpjxxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvseiv.vosoaseiv.lcjmil.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvseiv.vosoaseiv.manljw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvseiv.vosoaseiv.meqery.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvseiv.vosoaseiv.mltuey.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvseiv.vosoaseiv.mwhjux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvseiv.vosoaseiv.ncligz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvseiv.vosoaseiv.nmlubc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvseiv.vosoaseiv.nsetef.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvseiv.vosoaseiv.oqgpdd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvseiv.vosoaseiv.ovbfsv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvseiv.vosoaseiv.pczkai.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvseiv.vosoaseiv.pheudi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvseiv.vosoaseiv.pwzivx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvseiv.vosoaseiv.qnsjhm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvseiv.vosoaseiv.xjkfdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvseiv.vosoaseiv.xlftxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvseiv.vosoaseiv.yaaabg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvseiv.vosoaseiv.ywmdmi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvseiv.vosoaseiv.zbqfwh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivscvseiv.vosoaseiv.zhxqym.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseaasi.12380978.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseaasi.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseaasi.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseaasi.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseaasi.6378791.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseaasi.6945785.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseaasi.6978458.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseaasi.7786945.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseaasi.7997845.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseaasi.8676455.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseaasi.9784585.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseaasi.adijps.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseaasi.hdivud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseaasi.ijhojg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseaasi.ilblz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseaasi.ilqmcz.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200012405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseaasi.nedpvy.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200012406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseaasi.nnawja.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseaasi.otfake.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseaasi.rfygke.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseaasi.wjgomb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseaasi.xfpmrv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseaasi.xybwxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseaasi.xzeejb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseaasi.yangyang44.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200012414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseaasi.ykbzoq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseaasi.ynytah.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseaasi.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseaasi.yqpqaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseaasi.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseai.12380978.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseai.1366778.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseai.3968745.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseai.4358879.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseai.6978458.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseai.8676455.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseai.9784585.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseai.9978754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseai.aljreh.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200012428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseai.loqjz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseai.nnawja.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseai.otfake.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseai.rfygke.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseai.srrnqt.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200012433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseai.wjgomb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseai.wogwe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseai.xfpmrv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseai.xrwetd.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200012437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseai.xybwxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseai.ykbzoq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseai.ynytah.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseai.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseai.yqpqaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseai.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaoasrcsasoceoe.366778.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaoasrcsasoceoe.4687957.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaoasrcsasoceoe.6378791.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaoasrcsasoceoe.adijps.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaoasrcsasoceoe.blyqdj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaoasrcsasoceoe.hdivud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaoasrcsasoceoe.ijhojg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaoasrcsasoceoe.loqjz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaoasrcsasoceoe.nedpvy.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200012452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaoasrcsasoceoe.nnawja.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaoasrcsasoceoe.otfake.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaoasrcsasoceoe.wjgomb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaoasrcsasoceoe.xfpmrv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaoasrcsasoceoe.xybwxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaoasrcsasoceoe.ykbzoq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaoasrcsasoceoe.ynytah.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaoasrcsasoceoe.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaoasrcsasoceoe.yqpqaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaoasrcsasoceoe.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaocarsoasoceosecso.239978.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaocarsoasoceosecso.366778.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaocarsoasoceosecso.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaocarsoasoceosecso.5633845.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaocarsoasoceosecso.6978458.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaocarsoasoceosecso.7786945.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaocarsoasoceosecso.7997845.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaocarsoasoceosecso.8676455.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaocarsoasoceosecso.93544117.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaocarsoasoceosecso.9978754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaocarsoasoceosecso.aymaus.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200012473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaocarsoasoceosecso.hdivud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaocarsoasoceosecso.ijhojg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaocarsoasoceosecso.srrnqt.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200012476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaocarsoasoceosecso.vkzpru.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200012477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaocarsoasoceosecso.wjgomb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaocarsoasoceosecso.xfpmrv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaocarsoasoceosecso.xybwxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaocarsoasoceosecso.xzeejb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaocarsoasoceosecso.yangyang44.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200012482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaocarsoasoceosecso.ykbzoq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaocarsoasoceosecso.ynytah.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaocarsoasoceosecso.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaocarsoasoceosecso.yqpqaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaocarsoasoceosecso.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaosarsoasoceoseccsoi.1366778.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaosarsoasoceoseccsoi.239978.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaosarsoasoceoseccsoi.366778.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaosarsoasoceoseccsoi.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaosarsoasoceoseccsoi.3968745.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaosarsoasoceoseccsoi.4358879.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaosarsoasoceoseccsoi.4687957.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaosarsoasoceoseccsoi.5468785.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaosarsoasoceoseccsoi.6378791.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaosarsoasoceoseccsoi.9784585.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaosarsoasoceoseccsoi.9978754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaosarsoasoceoseccsoi.ilblz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaosarsoasoceoseccsoi.jbqbcfxgt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaosarsoasoceoseccsoi.nedpvy.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200012501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaosarsoasoceoseccsoi.nnawja.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaosarsoasoceoseccsoi.shzrab.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200012503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaosarsoasoceoseccsoi.srrnqt.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200012504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaosarsoasoceoseccsoi.vkzpru.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200012505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaosarsoasoceoseccsoi.wjgomb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaosarsoasoceoseccsoi.xfpmrv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaosarsoasoceoseccsoi.xrwetd.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200012508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaosarsoasoceoseccsoi.xybwxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaosarsoasoceoseccsoi.yangyang44.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200012510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaosarsoasoceoseccsoi.ykbzoq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaosarsoasoceoseccsoi.ynytah.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaosarsoasoceoseccsoi.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaosarsoasoceoseccsoi.yqpqaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaosarsoasoceoseccsoi.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaosarsoasoceosei.3997884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaosarsoasoceosei.4358879.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaosarsoasoceosei.4687957.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaosarsoasoceosei.5468785.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaosarsoasoceosei.6378791.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaosarsoasoceosei.6945785.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaosarsoasoceosei.7997845.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaosarsoasoceosei.9784585.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaosarsoasoceosei.adijps.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaosarsoasoceosei.blyqdj.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaosarsoasoceosei.hgzklt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaosarsoasoceosei.ijhojg.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaosarsoasoceosei.janbl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaosarsoasoceosei.jbqbcfxgt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaosarsoasoceosei.rfygke.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaosarsoasoceosei.wjgomb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaosarsoasoceosei.xfpmrv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaosarsoasoceosei.xybwxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaosarsoasoceosei.xzeejb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaosarsoasoceosei.ykbzoq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaosarsoasoceosei.ynytah.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaosarsoasoceosei.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaosarsoasoceosei.yqpqaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecseosacsaase.vsicsevscaosarsoasoceosei.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevccaosarsoasocoseaasi.4687957.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevccaosarsoasocoseaasi.5468785.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevccaosarsoasocoseaasi.5633845.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevccaosarsoasocoseaasi.6945785.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevccaosarsoasocoseaasi.8676455.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevccaosarsoasocoseaasi.adijps.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevccaosarsoasocoseaasi.aljreh.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200012546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevccaosarsoasocoseaasi.auxfvv.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200012547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevccaosarsoasocoseaasi.duikdo.online"; content:"Host"; http_header; classtype:attempted-recon; sid:200012548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevccaosarsoasocoseaasi.eaosey.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevccaosarsoasocoseaasi.hdjyfur.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200012550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevccaosarsoasocoseaasi.ilblz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevccaosarsoasocoseaasi.ilqmcz.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200012552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevccaosarsoasocoseaasi.rfygke.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevccaosarsoasocoseaasi.vkzpru.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200012554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevccaosarsoasocoseaasi.wjgomb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevccaosarsoasocoseaasi.xfpmrv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevccaosarsoasocoseaasi.xybwxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevccaosarsoasocoseaasi.ykbzoq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevccaosarsoasocoseaasi.ynytah.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevccaosarsoasocoseaasi.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevccaosarsoasocoseaasi.yqpqaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevccaosarsoasocoseaasi.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevccaosarsoasocoseai.1239978.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevccaosarsoasocoseai.3488754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevccaosarsoasocoseai.3968745.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevccaosarsoasocoseai.4687957.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevccaosarsoasocoseai.6378791.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevccaosarsoasocoseai.7786945.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevccaosarsoasocoseai.9978754.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevccaosarsoasocoseai.eaosey.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevccaosarsoasocoseai.hdivud.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevccaosarsoasocoseai.hgzklt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevccaosarsoasocoseai.jbqbcfxgt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevccaosarsoasocoseai.njlrxn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevccaosarsoasocoseai.nnawja.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevccaosarsoasocoseai.otfake.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevccaosarsoasocoseai.wjgomb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevccaosarsoasocoseai.wogwe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevccaosarsoasocoseai.xfpmrv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevccaosarsoasocoseai.xybwxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevccaosarsoasocoseai.ykbzoq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevccaosarsoasocoseai.ynytah.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevccaosarsoasocoseai.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevccaosarsoasocoseai.yqpqaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevccaosarsoasocoseai.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaoasrcsasocoe.12380978.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaoasrcsasocoe.1239978.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaoasrcsasocoe.1366778.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaoasrcsasocoe.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaoasrcsasocoe.4358879.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaoasrcsasocoe.5633845.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaoasrcsasocoe.6945785.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaoasrcsasocoe.6978458.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaoasrcsasocoe.9784585.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaoasrcsasocoe.adijps.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaoasrcsasocoe.eaosey.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaoasrcsasocoe.hgzklt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaoasrcsasocoe.ilblz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaoasrcsasocoe.jbqbcfxgt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaoasrcsasocoe.rfygke.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaoasrcsasocoe.wjgomb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaoasrcsasocoe.xfpmrv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaoasrcsasocoe.xybwxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaoasrcsasocoe.xzeejb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaoasrcsasocoe.yangyang44.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200012605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaoasrcsasocoe.ykbzoq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaoasrcsasocoe.ynytah.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaoasrcsasocoe.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaoasrcsasocoe.yqpqaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaoasrcsasocoe.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaocarsoasocosecso.12380978.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaocarsoasocosecso.239978.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaocarsoasocosecso.3667884.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaocarsoasocosecso.5633845.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaocarsoasocosecso.6378791.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaocarsoasocosecso.8676455.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaocarsoasocosecso.9784585.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaocarsoasocosecso.adijps.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaocarsoasocosecso.ankdujfkx.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200012619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaocarsoasocosecso.janbl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaocarsoasocosecso.nedpvy.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200012621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaocarsoasocosecso.nzvzoq.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200012622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaocarsoasocosecso.otfake.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaocarsoasocosecso.wjgomb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaocarsoasocosecso.wogwe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaocarsoasocosecso.xfpmrv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaocarsoasocosecso.xybwxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaocarsoasocosecso.ykbzoq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaocarsoasocosecso.ynytah.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaocarsoasocosecso.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaocarsoasocosecso.yqpqaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaocarsoasocosecso.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaosarsoasocoseccsoi.1366778.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaosarsoasocoseccsoi.5633845.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaosarsoasocoseccsoi.6378791.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaosarsoasocoseccsoi.6945785.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaosarsoasocoseccsoi.6978458.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaosarsoasocoseccsoi.adijps.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaosarsoasocoseccsoi.auxfvv.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200012639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaosarsoasocoseccsoi.ilblz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaosarsoasocoseccsoi.ilqmcz.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200012641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaosarsoasocoseccsoi.janbl.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaosarsoasocoseccsoi.jbqbcfxgt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaosarsoasocoseccsoi.nedpvy.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200012644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaosarsoasocoseccsoi.neqnpg.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200012645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaosarsoasocoseccsoi.nnawja.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaosarsoasocoseccsoi.wjgomb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaosarsoasocoseccsoi.xfpmrv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaosarsoasocoseccsoi.xybwxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaosarsoasocoseccsoi.yangyang44.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200012650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaosarsoasocoseccsoi.ykbzoq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaosarsoasocoseccsoi.ynytah.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaosarsoasocoseccsoi.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaosarsoasocoseccsoi.yqpqaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaosarsoasocoseccsoi.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaosarsoasocosei.1366778.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaosarsoasocosei.4687957.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaosarsoasocosei.7997845.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaosarsoasocosei.8676455.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaosarsoasocosei.93544117.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaosarsoasocosei.9784585.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaosarsoasocosei.ankdujfkx.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200012662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaosarsoasocosei.aymaus.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200012663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaosarsoasocosei.jbqbcfxgt.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaosarsoasocosei.nedpvy.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200012665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaosarsoasocosei.nnawja.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaosarsoasocosei.nzvzoq.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200012667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaosarsoasocosei.otfake.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaosarsoasocosei.wjgomb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaosarsoasocosei.wogwe.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaosarsoasocosei.xfpmrv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaosarsoasocosei.xrwetd.space"; content:"Host"; http_header; classtype:attempted-recon; sid:200012672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaosarsoasocosei.xybwxx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaosarsoasocosei.xzeejb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaosarsoasocosei.ykbzoq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaosarsoasocosei.ynytah.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaosarsoasocosei.yohzhg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaosarsoasocosei.yqpqaw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsesacsaase.vsicsevscaosarsoasocosei.yzkznk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsosein.vvseaaiaseon.rezkdk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsosein.vvseaaiaseon.roiysf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsosein.vvseaaiaseon.trxpth.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsosein.vvseaaiaseon.tsqcxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsosein.vvseaaiaseon.txvcqg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsecsosein.vvseaaiaseon.wdzxnt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseosein.vvsaiaseon.rlyndd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseosein.vvsaiaseon.tqsnfg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseosein.vvsaiaseon.tsqcxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseosein.vvsaiaseon.uxhejc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.0633348.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.1223478.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.15537777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.2354387.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.2355587.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.3333347.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.3456588.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.3533357.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.3545331.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.3556678.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.3888347.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.4478687.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.4488877.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.4566368.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.4566878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.4678865.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.4687999.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.5378887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.5387814.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.6123878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.6366778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.6788777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.6788877.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.6887453.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.6975877.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.6979885.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.7688477.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.7788513.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.9556788.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.9978777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.9997854.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.9997875.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.ahiatgp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.ahibtgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.ahictgl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.ahidtgf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.ahigtgg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.ahihtgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.avmueo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.biyzde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.bozoob.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.cderfv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.fmrxl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.gpsjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.hdjtd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.ipnnct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.iwggbt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.izokl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.jayocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.jqwgwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.kbjbz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.lheqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.lzprqf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.mhftfp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.npibd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.ohvcp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.ojpih.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.pfbueg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.plcxj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.qglno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.qqwhps.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.rbfmfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.sfts.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200012761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.sfts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.uynfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.velxb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.vnbxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.vppvl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.xopup.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.ylbde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.ymgar.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosaasi.ypzcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.0633348.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.1223478.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.15537777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.2354387.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.2355587.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.3333347.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.3456588.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.3533357.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.3545331.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.3556678.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.3888347.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.4478687.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.4488877.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.4566368.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.4566878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.4678865.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.4687999.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.5378887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.5387814.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.6123878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.6366778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.6788777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.6788877.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.6887453.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.6975877.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.6979885.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.7688477.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.7788513.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.9556788.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.9978777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.9997854.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.9997875.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.ahiatgp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.ahibtgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.ahictgl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.ahidtgf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.ahigtgg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.ahihtgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.avmueo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.biyzde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.bozoob.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.fmrxl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.gpsjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.hdjtd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.ipnnct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.iwggbt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.izokl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.jayocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.jqwgwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.kbjbz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.lheqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.lsksodi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.mhftfp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.npanni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.npibd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.ohvcp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.ojpih.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.pfbueg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.plcxj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.qglno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.qqwhps.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.rbfmfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.sfts.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200012843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.sfts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.uynfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.velxb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.vnbxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.vppvl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.xopup.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.ylbde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.ymgar.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvceosai.ypzcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.0633348.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.1223478.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.15537777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.2354387.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.2355587.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.3333347.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.3456588.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.3533357.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.3545331.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.3556678.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.3888347.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.4478687.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.4488877.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.4566368.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.4566878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.4678865.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.4687999.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.5378887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.5387814.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.6123878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.6366778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.6788777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.6788877.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.6887453.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.6975877.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.6979885.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.7688477.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.7788513.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.9556788.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.9978777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.9997854.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.9997875.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.ahiatgp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.ahibtgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.ahictgl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.ahidtgf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.ahigtgg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.ahihtgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.avmueo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.biyzde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.bozoob.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.fmrxl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.gpsjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.hdjtd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.ipnnct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.iwggbt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.izokl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.jayocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.jqwgwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.kbjbz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.lheqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.lsaaas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.lslois.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.mhftfp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.npibd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.ohvcp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.ojpih.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.pfbueg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.plcxj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.qglno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.qqwhps.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.rbfmfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.sfts.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200012925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.sfts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.uynfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.velxb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.vnbxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.vppvl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.xopup.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.ylbde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.ymgar.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasccsoi.ypzcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.0633348.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.1223478.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.15537777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.2354387.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.2355587.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.3333347.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.3456588.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.3533357.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.3545331.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.3556678.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.3888347.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.4478687.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.4488877.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.4566368.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.4566878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.4678865.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.4687999.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.5378887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.5387814.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.6123878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.6366778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.6788777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.6788877.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.6887453.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.6975877.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.6979885.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.7688477.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.7788513.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.9556788.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.9978777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.9997854.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.9997875.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200012971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.ahiatgp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.ahibtgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.ahictgl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.ahidtgf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.ahigtgg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.ahihtgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.avmueo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.biyzde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.bozoob.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.cjsuye.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.fmrxl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.gpsjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.hdjtd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.ipnnct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.iwggbt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.izokl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.jayocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.jqwgwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.kbjbz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.lheqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.lsaaas.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.mengdie.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200012997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.mhftfp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.npibd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200012999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.ohvcp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.ojpih.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.pfbueg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.plcxj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.qglno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.qqwhps.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.rbfmfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.sdaere.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.sfts.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200013009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.sfts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.uynfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.velxb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.vnbxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.vppvl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.xopup.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.ylbde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.ymgar.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaasi.ypzcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.0633348.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.1223478.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.15537777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.2354387.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.2355587.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.3333347.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.3456588.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.3533357.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.3545331.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.3556678.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.3888347.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.4478687.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.4488877.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.4566368.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.4566878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.4678865.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.4687999.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.5378887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.5387814.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.6123878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.6366778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.6788777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.6788877.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.6887453.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.6975877.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.6979885.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.7788513.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.9556788.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.9978777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.9997854.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.9997875.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.ahiatgp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.ahibtgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.ahictgl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.ahidtgf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.ahigtgg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.ahihtgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.avmueo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.biyzde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.bozoob.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.fmrxl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.gpsjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.hdjtd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.ipnnct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.iwggbt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.izokl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.jayocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.jqwgwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.kbjbz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.lheqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.mhftfp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.npibd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.ohvcp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.ojpih.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.pfbueg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.plcxj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.qglno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.qqwhps.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.rbfmfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.sfts.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200013088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.sfts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.uynfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.velxb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.vnbxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.vppvl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.xopup.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.ylbde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.ymgar.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsai.ypzcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.0633348.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.1223478.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.1345578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.15537777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.2355587.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.3333347.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.3456588.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.3533357.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.3545331.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.3556678.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.3888347.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.4478687.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.4488877.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.4566368.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.4566878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.4678865.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.4687999.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.5378887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.5387814.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.5577778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.6123878.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.6366778.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.6788665.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.6788777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.6788877.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.6876578.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.6887453.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.6975877.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.6979885.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.7688477.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.7788513.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.9556788.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.9978777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.9997854.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.9997875.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.ahiatgp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.ahibtgs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.ahictgl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.ahidtgf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.ahigtgg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.ahihtgn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.avmueo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.baskb.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.biyzde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.bozoob.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.cjkin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.dkvvuy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.dohsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.fmrxl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.gpsjf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.gzmvuo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.hdjtd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.hsujdiw.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200013151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.ipnnct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.iwggbt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.izokl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.jayocp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.jqwgwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.kbjbz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.lheqv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.lokasid.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.lslois.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.lzprqf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.mhftfp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.npanni.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.npibd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.ohvcp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.ojpih.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.pfbueg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.plcxj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.qglno.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.qqwhps.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.qwuchl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.rbfmfa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.sfts.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200013173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.sfts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.uvoeb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.uynfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.velxb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.vnbxy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.vppvl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.xopup.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.ylbde.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.ymgar.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesa.vsicvsaiccso.ypzcv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvceosascoseaasi.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvceosascoseaasi.cemlfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvceosascoseaasi.chaincomp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvceosascoseaasi.dwrnsk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvceosascoseaasi.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvceosascoseaasi.eesnax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvceosascoseaasi.gwrlwh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvceosascoseaasi.gwrrdx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvceosascoseaasi.hzzpvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvceosascoseaasi.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvceosascoseaasi.jcqpfm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvceosascoseaasi.kihmid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvceosascoseaasi.ksiudjfo.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvceosascoseaasi.kzstoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvceosascoseaasi.ojfyvi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvceosascoseaasi.pajngn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvceosascoseaasi.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvceosascoseaasi.sbelxi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvceosascoseaasi.sdutxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvceosascoseaasi.sfts.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200013203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvceosascoseaasi.sfts.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200013204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvceosascoseaasi.ssminn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvceosascoseaasi.tilgij.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvceosascoseaasi.vyihmf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvceosascoseaasi.wfmcjb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvceosascoseai.bkcuph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvceosascoseai.cartil.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvceosascoseai.cemlfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvceosascoseai.cipgmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvceosascoseai.coinwallet.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvceosascoseai.duppjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvceosascoseai.fmttqq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvceosascoseai.gwrlwh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvceosascoseai.gwrrdx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvceosascoseai.kihmid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvceosascoseai.msqkez.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvceosascoseai.nlcrmz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvceosascoseai.onazqm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvceosascoseai.owbxts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvceosascoseai.tjkoas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvceosascoseai.ucluzr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvceosascoseai.uhijmv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvceosascoseai.vfelco.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvceosascoseai.vgedvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvceosascoseai.wtkiwf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvceosascoseai.xjdpgi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvceosascoseai.yagtso.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvceosascoseai.yalpuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvceosascoseai.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaasascoseccsoi.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaasascoseccsoi.1444588.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaasascoseccsoi.2124458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaasascoseccsoi.bcjgin.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaasascoseccsoi.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaasascoseccsoi.cartil.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaasascoseccsoi.cemlfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaasascoseccsoi.chaincomp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaasascoseccsoi.dkfrva.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaasascoseccsoi.dwrnsk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaasascoseccsoi.ewdbda.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaasascoseccsoi.flyveb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaasascoseccsoi.fmttqq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaasascoseccsoi.fuufvw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaasascoseccsoi.gwrlwh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaasascoseccsoi.gwrrdx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaasascoseccsoi.ilfbdb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaasascoseccsoi.jcqpfm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaasascoseccsoi.kobagq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaasascoseccsoi.nlcrmz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaasascoseccsoi.nthuga.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaasascoseccsoi.owbxts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaasascoseccsoi.sbelxi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaasascoseccsoi.tohjkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaasascoseccsoi.ugelbf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaasascoseccsoi.uhijmv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaasascoseccsoi.yezuns.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaasascoseccsoi.yifpgd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaasascoseccsoi.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaasascoseccsoi.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaasascosei.aulscd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaasascosei.bgjjoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaasascosei.bjdsqz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaasascosei.cartil.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaasascosei.cemlfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaasascosei.cipgmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaasascosei.dsyqit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaasascosei.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaasascosei.gwrrdx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaasascosei.hzwrnd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaasascosei.kihmid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaasascosei.nthuga.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaasascosei.qjgmxi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaasascosei.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaasascosei.sdutxg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaasascosei.sfts.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200013278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaasascosei.ugelbf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaasascosei.vgedvy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaasascosei.wfmcjb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaasascosei.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaasascosei.yczpuk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaiascose.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaiascose.1444588.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaiascose.cartil.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaiascose.cipgmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaiascose.coinwallet.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaiascose.dwrnsk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaiascose.dxsahh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaiascose.hzzpvv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaiascose.jaftcq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaiascose.kihmid.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaiascose.ksiudjfo.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaiascose.mrogod.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaiascose.ojfyvi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaiascose.owbxts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaiascose.ptohrn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaiascose.tdvpct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaiascose.tjkoas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaiascose.tohjkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaiascose.txbrht.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaiascose.ucluzr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaiascose.umjnpy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaiascose.vjzvtr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaiascose.vvdmwv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaiascose.vyihmf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaiascose.xchztf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaiascose.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaiascose.yalpuh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaicascosecso.1112458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaicascosecso.cemlfv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaicascosecso.cipgmk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaicascosecso.dsyqit.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaicascosecso.duppjc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaicascosecso.exqkjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaicascosecso.jtpyia.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaicascosecso.ksiudjfo.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaicascosecso.kzstoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaicascosecso.ojfyvi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaicascosecso.owbxts.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaicascosecso.qqwfas.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaicascosecso.sfts.pro"; content:"Host"; http_header; classtype:attempted-recon; sid:200013323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaicascosecso.tohjkg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaicascosecso.uhijmv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaicascosecso.xvlbws.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaicascosecso.yczpuk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaicascosecso.yjefsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesaccase.vsicvsaicascosecso.zgzemr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesecsosein.vvssaeaaiaseon.rezkdk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesecsosein.vvssaeaaiaseon.rusnrh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesecsosein.vvssaeaaiaseon.sgsgyb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesecsosein.vvssaeaaiaseon.sscssr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesecsosein.vvssaeaaiaseon.tkozlg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesecsosein.vvssaeaaiaseon.twjzsc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesecsosein.vvssaeaaiaseon.txvcqg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesecsosein.vvssaeaaiaseon.uasxxj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesecsosein.vvssaeaaiaseon.uudnmz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseseosein.vvsaisaaseon.txvcqg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseseosein.vvsaisaaseon.txxbks.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseseosein.vvsaisaaseon.upjhye.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseseosein.vvsaisaaseon.vxcgax.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivseseosein.vvsaisaaseon.webyzs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevcceaoosearescoooseaasi.rdoryw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevcceaoosearescoooseai.3978458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevcceaoosearescoooseai.3978487.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevcceaoosearescoooseai.3978844.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevcceaoosearescoooseai.6156875.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevcceaoosearescoooseai.aehkez.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevcceaoosearescoooseai.bhmnyn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevcceaoosearescoooseai.bmbrqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevcceaoosearescoooseai.ckeqkb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevcceaoosearescoooseai.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevcceaoosearescoooseai.davgri.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevcceaoosearescoooseai.djicub.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevcceaoosearescoooseai.ehzdsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevcceaoosearescoooseai.fftefq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevcceaoosearescoooseai.fqaqay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevcceaoosearescoooseai.fvzlph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevcceaoosearescoooseai.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevcceaoosearescoooseai.homhcy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevcceaoosearescoooseai.krxyum.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevcceaoosearescoooseai.kthlcb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200013363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevcceaoosearescoooseai.mfwrsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevcceaoosearescoooseai.mijkvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevcceaoosearescoooseai.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevcceaoosearescoooseai.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevcceaoosearescoooseai.oeeppj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevcceaoosearescoooseai.olbrdx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevcceaoosearescoooseai.owhfzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevcceaoosearescoooseai.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevcceaoosearescoooseai.qmozk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevcceaoosearescoooseai.qmponh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevcceaoosearescoooseai.raymtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevcceaoosearescoooseai.rdoryw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevcceaoosearescoooseai.rgwvvl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevcceaoosearescoooseai.rinlvb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevcceaoosearescoooseai.rtvsct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevcceaoosearescoooseai.rxqkhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevcceaoosearescoooseai.ssmkdz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevcceaoosearescoooseai.sswfzk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevcceaoosearescoooseai.subkwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevcceaoosearescoooseai.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevcceaoosearescoooseai.urolol.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevcceaoosearescoooseai.vneggf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevcceaoosearescoooseai.vzfbiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevcceaoosearescoooseai.wxjoux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevcceaoosearescoooseai.xfcxny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevcceaoosearescoooseai.xrrtvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescoooseccsoi.2397874.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescoooseccsoi.3123978.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescoooseccsoi.3197874.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescoooseccsoi.3299978.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescoooseccsoi.3877845.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescoooseccsoi.3997887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescoooseccsoi.9912447.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescoooseccsoi.aehkez.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescoooseccsoi.bhmnyn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescoooseccsoi.bmbrqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescoooseccsoi.ckeqkb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescoooseccsoi.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescoooseccsoi.davgri.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescoooseccsoi.djicub.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescoooseccsoi.ehzdsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescoooseccsoi.fftefq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescoooseccsoi.fqaqay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescoooseccsoi.fvzlph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescoooseccsoi.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescoooseccsoi.homhcy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescoooseccsoi.krxyum.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescoooseccsoi.kthlcb.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200013411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescoooseccsoi.mfwrsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescoooseccsoi.mijkvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescoooseccsoi.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescoooseccsoi.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescoooseccsoi.oeeppj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescoooseccsoi.olbrdx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescoooseccsoi.owhfzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescoooseccsoi.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescoooseccsoi.qmozk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescoooseccsoi.qmponh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescoooseccsoi.raymtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescoooseccsoi.rdoryw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescoooseccsoi.rgwvvl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescoooseccsoi.rinlvb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescoooseccsoi.rtvsct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescoooseccsoi.rxqkhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescoooseccsoi.ssmkdz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescoooseccsoi.sswfzk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescoooseccsoi.subkwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescoooseccsoi.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescoooseccsoi.urolol.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescoooseccsoi.vneggf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescoooseccsoi.vzfbiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescoooseccsoi.wxjoux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescoooseccsoi.xfcxny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescoooseccsoi.xrrtvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescooosei.1397848.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescooosei.1978777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescooosei.2397874.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescooosei.3123978.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescooosei.3548738.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescooosei.3587841.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescooosei.3877845.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescooosei.3978458.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescooosei.3978844.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescooosei.3987845.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescooosei.6156875.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescooosei.aehkez.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescooosei.bhmnyn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescooosei.bmbrqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescooosei.ckeqkb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescooosei.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescooosei.davgri.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescooosei.djicub.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescooosei.ehzdsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescooosei.fftefq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescooosei.fqaqay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescooosei.fvzlph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescooosei.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescooosei.homhcy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescooosei.krxyum.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescooosei.mfwrsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescooosei.mijkvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescooosei.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescooosei.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescooosei.oeeppj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescooosei.olbrdx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescooosei.owhfzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescooosei.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescooosei.qmponh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescooosei.raymtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescooosei.rdoryw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescooosei.rgwvvl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescooosei.rinlvb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescooosei.rtvsct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescooosei.rxqkhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescooosei.ssmkdz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescooosei.sswfzk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescooosei.subkwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescooosei.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescooosei.urolol.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescooosei.vneggf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescooosei.vzfbiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescooosei.wxjoux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescooosei.xfcxny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaaosearescooosei.xrrtvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaioaesrecosooe.3197874.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaioaesrecosooe.3299978.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaioaesrecosooe.3548738.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaioaesrecosooe.3877845.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaioaesrecosooe.3978844.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaioaesrecosooe.3987845.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaioaesrecosooe.3997887.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaioaesrecosooe.aehkez.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaioaesrecosooe.bhmnyn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaioaesrecosooe.bmbrqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaioaesrecosooe.ckeqkb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaioaesrecosooe.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaioaesrecosooe.davgri.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaioaesrecosooe.djicub.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaioaesrecosooe.ehzdsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaioaesrecosooe.fftefq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaioaesrecosooe.fqaqay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaioaesrecosooe.fvzlph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaioaesrecosooe.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaioaesrecosooe.homhcy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaioaesrecosooe.krxyum.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaioaesrecosooe.mfwrsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaioaesrecosooe.mijkvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaioaesrecosooe.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaioaesrecosooe.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaioaesrecosooe.oeeppj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaioaesrecosooe.olbrdx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaioaesrecosooe.owhfzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaioaesrecosooe.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaioaesrecosooe.qmozk.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaioaesrecosooe.qmponh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaioaesrecosooe.raymtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaioaesrecosooe.rdoryw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaioaesrecosooe.rgwvvl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaioaesrecosooe.rinlvb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaioaesrecosooe.rtvsct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaioaesrecosooe.rxqkhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaioaesrecosooe.ssmkdz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaioaesrecosooe.sswfzk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaioaesrecosooe.subkwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaioaesrecosooe.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaioaesrecosooe.urolol.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaioaesrecosooe.vneggf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaioaesrecosooe.vzfbiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaioaesrecosooe.wxjoux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaioaesrecosooe.xfcxny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaioaesrecosooe.xrrtvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaiocearescooosecso.1397848.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaiocearescooosecso.1978777.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaiocearescooosecso.2397874.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaiocearescooosecso.3197874.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaiocearescooosecso.3215479.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaiocearescooosecso.3299978.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaiocearescooosecso.3548738.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaiocearescooosecso.3587841.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaiocearescooosecso.3877845.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaiocearescooosecso.3978844.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaiocearescooosecso.aehkez.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaiocearescooosecso.bhmnyn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaiocearescooosecso.bmbrqh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaiocearescooosecso.ckeqkb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaiocearescooosecso.cxiitv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaiocearescooosecso.davgri.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaiocearescooosecso.djicub.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaiocearescooosecso.ehzdsx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaiocearescooosecso.fftefq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaiocearescooosecso.fqaqay.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaiocearescooosecso.fvzlph.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaiocearescooosecso.hggluj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaiocearescooosecso.homhcy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaiocearescooosecso.krxyum.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaiocearescooosecso.mfwrsg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaiocearescooosecso.mijkvd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaiocearescooosecso.mugnqj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaiocearescooosecso.nphgoc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaiocearescooosecso.oeeppj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaiocearescooosecso.olbrdx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaiocearescooosecso.owhfzz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaiocearescooosecso.qhnqwt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaiocearescooosecso.qmponh.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaiocearescooosecso.raymtl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaiocearescooosecso.rdoryw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaiocearescooosecso.rgwvvl.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaiocearescooosecso.rinlvb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaiocearescooosecso.rtvsct.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaiocearescooosecso.rxqkhw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaiocearescooosecso.ssmkdz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaiocearescooosecso.sswfzk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaiocearescooosecso.subkwb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaiocearescooosecso.tzwpfn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaiocearescooosecso.urolol.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaiocearescooosecso.vneggf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaiocearescooosecso.vzfbiy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaiocearescooosecso.wxjoux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaiocearescooosecso.xfcxny.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsesesaccsaase.vsicsevscaaiocearescooosecso.xrrtvf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcaei.vsacsei.duogfk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcaei.vsacsei.dzzeqx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcaei.vsacsei.fslqoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcaei.vsacsei.fybblw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcaei.vsacsei.gobdkk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcaei.vsacsei.gpqthb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcaei.vsacsei.hjvbkp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcaei.vsacsei.hnekal.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcaei.vsacsei.hqmwaa.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceaesi.ovsacsei.bbrnog.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceaesi.ovsacsei.ebttmd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceaesi.ovsacsei.fpmrgv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceaesi.ovsacsei.fsmiwc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceaesi.ovsacsei.gjpxih.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceaesi.ovsacsei.jbsdyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvceaesi.ovsacsei.kcdhgz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcesaseio.vcsacsei.ajgvac.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcesaseio.vcsacsei.cfmuyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcesaseio.vcsacsei.fslqoi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcesaseio.vcsacsei.hvolmq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcsaei.vcsacsei.agawbs.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcsaei.vcsacsei.cfmuyq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcsaei.vcsacsei.elvlic.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcsaei.vcsacsei.eorvbo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcsaei.vcsacsei.irrjrk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvcsaei.vcsacsei.jbsdyf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvesi.vsccacsei.adqdwg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvesi.vsccacsei.agjlyk.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvesi.vsccacsei.aiabsd.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvesi.vsccacsei.bdctxj.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvesi.vsccacsei.bdlzvc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvesi.vsccacsei.bmozhr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvesi.vsccacsei.chgskm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvesi.vsccacsei.cyzemc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvesi.vsccacsei.czexys.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvesi.vsccacsei.demtjo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvesi.vsccacsei.dhvprp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvesi.vsccacsei.dlsefg.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvesi.vsccacsei.dtosxr.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvesi.vsccacsei.eghloo.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvesi.vsccacsei.egniix.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvesi.vsccacsei.ehsiyy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvesi.vsccacsei.eiaohy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvesi.vsccacsei.eiblhv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvesi.vsccacsei.eonors.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvesi.vsccacsei.fgopqn.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvesi.vsccacsei.fntxet.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvesi.vsccacsei.govwoy.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvesi.vsccacsei.gqnrcz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvesi.vsccacsei.iesklv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvesi.vsccacsei.iwwocw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvesi.vsccacsei.jjtgpt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvesi.vsccacsei.luhbim.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvesi.vsccacsei.mltuey.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvesi.vsccacsei.mrnwky.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvesi.vsccacsei.mwhjux.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvesi.vsccacsei.nmlubc.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvesi.vsccacsei.pheudi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvesi.vsccacsei.xhaivw.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvesi.vsccacsei.xjkfdv.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvesi.vsccacsei.xlftxp.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvesi.vsccacsei.xlokjz.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvesi.vsccacsei.xvebfx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvesi.vsccacsei.ywmdmi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vivsvesi.vsccacsei.zwldnt.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vkmatka.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200013649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vkontakte.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vm26012022.s3.fr-par.scw.cloud"; content:"Host"; http_header; classtype:attempted-recon; sid:200013651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vmboxx.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vodafone.updts.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200013653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vodaupdatepayment.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"voiceacademy.international"; content:"Host"; http_header; classtype:attempted-recon; sid:200013655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"voicemail-refbe4d.sharedfiles-auth.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"voiceorangeo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"volcano-webmail23.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200013658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"volvocarskc.us1.list-manage.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vopro.podia.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vouchere-astrazeneca.totemsoftware.ro"; content:"Host"; http_header; classtype:attempted-recon; sid:200013661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vps13276.inmotionhosting.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vr-bank-39611.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vrindagarden.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vroptaq.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vtmjeopbif.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vtrq51.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vtxmail2018.myfreesites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200013668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vvanm.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vvntechnologies.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vwergverg-rjkbg-jet-bnjm-ejtnmb-e9otrbj9torjb.obs.ap-southeast-2.myhuaweicloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vxdse.myfreesites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200013672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"vystarcu.writtenmirror.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"w3klshfla.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200013674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"w5wmtbanking.ddns.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200013675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"w9eventos.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wa.mfs.gg"; content:"Host"; http_header; classtype:attempted-recon; sid:200013677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wahed-koudsi2001.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200013678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"waiiat-paiygon.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"walken.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"walldesign.com.tr"; content:"Host"; http_header; classtype:attempted-recon; sid:200013681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wallet-connect012.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wallet-polygon.login-en.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wallet.neeaar.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wallet.polygon-technology.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200013685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wallet.roninchain.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200013686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wallet.silesiacoin.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"walletconmect.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"walletmigrateweb3.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"walletreconcile.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wallets-update.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200013691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"walletscsupp0rtcentar.website2.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200013692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"walletsencrypts.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"walletvalidators.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"walletverification.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200013695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"walletverify.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200013696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"walletzfix.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wana78420.myfreesites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200013698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wandering-fire-1c00.jamaljewellerry356.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"waqassupplies.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"warsa.bandungkab.go.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200013701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wartanesia.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200013702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"watchess.com.pk"; content:"Host"; http_header; classtype:attempted-recon; sid:200013703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"waterfordlogistics.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"watersedgetechservices.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"waves-enterprise.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wayoflife.fit"; content:"Host"; http_header; classtype:attempted-recon; sid:200013707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wayoflife.fitness"; content:"Host"; http_header; classtype:attempted-recon; sid:200013708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wayuai.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wcqcwzxddzf67qewwahflxc.we9ixzz.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200013710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wdscx.vqkztyy.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200013711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wealthspaninvestment.marketgriddev.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200013712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"weathered-king-77ec.noxexexe.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"weathered.mnevicionzone.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-94b47.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-client-103863.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-exoduss.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-mtbalert.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-sand-home.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-soc.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web-soc.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.activationaccess.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.bredbanque.trans.sylog.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200013723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.logodesign.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200013724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.prodepo.com.tr"; content:"Host"; http_header; classtype:attempted-recon; sid:200013725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web.securemainappnet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web3.clients-demo-website.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web3coi.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web3nodeapp.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200013729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web8226.web07.bero-webspace.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200013730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"web8229.web07.bero-webspace.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200013731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webairbnb.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webbb1infocc1-it.preview-domain.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webclient.moreapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webconnectappsync.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webdatamltrainingdiag842.blob.core.windows.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200013736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webemail-upgradewolis.hicabor678.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webemailsteep-qwertboa-1aeb.a1610.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmail-100618.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmail-101708.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmail-108523.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmail-108669.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmail-109567-105381.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmail-cisco.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmail-cisco.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmail-laposte19.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmail-laposte27.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmail-roundcubeblack.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmail-roundcubeblack.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmail-sfr-fr.nitricoxidefacts.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmail-sso8uyg.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmail-www.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmail.bellahills.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmail.salemgroups.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmail6.networksolutionsemail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmail81pne.mailsrrsso908.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmailadmin0.myfreesites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200013757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmailbt-105963.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmaildatazugch-106337.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200013759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webmailoutl.zyrosite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webnodefix.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webrestor4-login8boa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webseguridadportalbancadavivienda.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webservice-mailupdatemail.arqanexportcompany1664.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webstories.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webwalletsdapp.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200013766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"webzonapinchicha.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wefcedvcfrev.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"welcomeacces.ga"; content:"Host"; http_header; classtype:attempted-recon; sid:200013769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wells-alertsp01.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wells-alertsp01.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"weplays-connect.tv"; content:"Host"; http_header; classtype:attempted-recon; sid:200013772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wercx.ljubsig.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200013773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"westcoastfeels.ca"; content:"Host"; http_header; classtype:attempted-recon; sid:200013774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"westrockozarksjobs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"westwoodfox.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wetl4h4ldf.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200013777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wetransfe-f5044.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wetransfe-f5044.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"weyadvocacia.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200013780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wfdrcx.kfgijry.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200013781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wfsec1f4rg0.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wgfdbs.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200013783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"whare.100webspace.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200013784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"whatsapp-blaster.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wheelsofmercy.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"white-block-2e16.desatt.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"white-bush-4bbc.goldenwolf542.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"whitetzfx.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"widadkamillah.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200013790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"widget-dot-lbk-asistente-pre-principal.appspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"widi-ba.preview-domain.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"widibank-id.preview-domain.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"widibawebconto-com.preview-domain.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wiitn-eqaaa-aaaad-qdb2a-cai.raw.ic0.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wild-star-f174.4882sddxshaee.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wildlywonderfulwomanhood.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"windowsupdaterev.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"windstream-net.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"winter-heart-4660.peasemeoff.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"winter-thunder-a1ba.gdjklahdkjsadampie.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"winterberrytech.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wireconfirmation68c10a25442a3e13.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wires-business-starter.webflow.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200013804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wisekyc0011.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wisekyc0011.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wisekyc0012.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wisekyc002.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wisekyc002.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wisekyc003.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wisekyc004.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wisekyc004.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wisekyc005.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wisekyc006.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wisekyc007.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wisekyc008.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wisekyc008.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wisekycnote11.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wisekycnote12.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wisekycnote13.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wisekycnote13.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wisekycnote15.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wisekycnote15.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wisekycnote2.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wisekycnote2.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wisekycnote3.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wisekycnote4.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wisekycnote9.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wisgjgjhtios.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wisgjgjhtios.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wispy-glitter-dec5.extraspo.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"withered-union-2058.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200013832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"withsupportaids.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wkazisan.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200013834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wkjjfw6e91sncrd.qwo231sdx.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200013835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wlc-idiomas.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wltcnt08201.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wolfondfinancial-shared-outl00k-folders.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"woliot-pejygem.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"worddocoffice365.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wordpress-82879-0.cloudclusters.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200013841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wordpress-83245-0.cloudclusters.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200013842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"workprotocoles-com.webs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"world-js.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wp-login.azurewebsites.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200013845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wp1sl706.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wpsoar.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ws.alleqro.pl.priyadarshi.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200013848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wt23khlkfvajk1.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200013849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wubujjs.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200013850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wv3vajpaeass.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wvvmobils.solcidesemboisomesdejulio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wvw.inbankpersonzeguro.promosprestamoparaloquencesitesfiestaspatrias.shop"; content:"Host"; http_header; classtype:attempted-recon; sid:200013853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wvwsorare-com.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ww1.ibkcredit.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ww11.lbk-personas.website"; content:"Host"; http_header; classtype:attempted-recon; sid:200013856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ww25.falabellabanco.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ww74.caixa.portal-atendimento.ltd"; content:"Host"; http_header; classtype:attempted-recon; sid:200013858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwqfdc.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwv-bombcrypto-log.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www-aeon-co-jp.udekong.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www-app22.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200013862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www-bitflyer-go-com-br.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www-cita-previa-en-linea-cr.yolasite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www-cursosdigitalesmx-com.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www-degelyehuda-org-il.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www-dofus-com.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200013867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www-europe564598-com.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www-europessign-com.filesusr.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www-jaccs-co-jp.i8l7if28.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www-pancake-swap.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www-raydium.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www1.aenoavun.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www1.wiisa.co.jp.aboing.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200013874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.aenoavcu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.aenoaven.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.aenoavun.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.aenocoz.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.aenocuzu.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.aenocven.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.aenoczd.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.aenoczi.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.aenoczm.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.aenoczn.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.aenoczo.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.aenoczr.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.aenoczs.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.aenoczv.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.aenorven.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.aenouven.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.aenozven.icu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.aeoni.co.jp.sahgf.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.anazaon.co.jp.login.fvmzgkm.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200013893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.anazaon.co.jp.login.hroukib.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200013894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.anazaon.co.jp.login.pznufll.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200013895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.anazaon.co.jp.login.x5yu4mw.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200013896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.anazaon.co.jp.login.xpfixsp.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200013897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.jcb.co.jp.kllrktq.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200013898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.jcb.co.jp.kmzygcj.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200013899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www2.myjcb.com.jp.j15fz3p.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200013900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www3.apllusi.co.jp.logm2bi.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www3.aplos.co.jp.login-asp.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200013902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www3.cmtb.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www3.idpass-net.nenkin.go.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200013904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"www5.shinsie.uplus.loging1-php.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwwhomedecoration.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"wwwipko.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200013907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"x4zyz4.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200013908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xas.vashonlove.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xcazsc.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xfeoxxokua9.typeform.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xfinittyyy-acct-verfyy-block-contentt.000webhostapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xfinniityinox.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xghlsp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xjfdgdfhgdhu.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200013915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xn----ctbeu0aamfekp0m.xn--p1ai"; content:"Host"; http_header; classtype:attempted-recon; sid:200013916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xn--allgrolokalnie-x4b.pl"; content:"Host"; http_header; classtype:attempted-recon; sid:200013917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xn--conta-atualiza-o-snb5e.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xn--f1a.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xn--f1a.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xn34r.app.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200013921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xonconnect3-8c2b41.ingress-earth.ewp.live"; content:"Host"; http_header; classtype:attempted-recon; sid:200013922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xotouch.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xpress24.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xqcpeou.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xsbrookshhjx.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xvalhalla.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200013927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xvlkbfdkidiboirioribriivirnifjri.weebly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xxk.vashonlove.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xxsw.ldsage.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xxsw.muuiwm.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200013931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"xxx-com-dot-c2c01-531c7.uc.r.appspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahoo-jp.jymjj.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200013933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahoo-jp.nbcloud.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200013934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahoo-jp.tmxk.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200013935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahoo.mailservice.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahoo.onlinemail.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yahuomall.square.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200013938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yairix.github.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200013939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yal.su"; content:"Host"; http_header; classtype:attempted-recon; sid:200013940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yalena.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200013941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yape-fake.vercel.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yaqoobi.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yaris-school.thinkific.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yaseminhidir.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yatienadzli.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yayanti.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yc2.nanningboring.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ycarujq.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200013949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yd04888.vip"; content:"Host"; http_header; classtype:attempted-recon; sid:200013950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yesgeenews.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yfse9m8arp.qwo231sdx.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200013952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ygzpoorsysjk6fzumtepa-apsuiteorangemail.ulcraft.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yhfbdxbxhsdujd.weeblysite.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yhtrdv.xwimrq.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200013955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yingtanrz.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yip.su"; content:"Host"; http_header; classtype:attempted-recon; sid:200013957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yma1ll0g0n.odoo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yniykzassaz.hostfree.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200013959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ynsao.godaddysites.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yogalife.com.np"; content:"Host"; http_header; classtype:attempted-recon; sid:200013961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yogdarshan.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yogicpa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yogini-polygonbc.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"youn.bxxnskkdkdkrkrnfnf.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"young-salad-b064.dealtrap5421683.workers.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200013966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yourkidsheart.ca"; content:"Host"; http_header; classtype:attempted-recon; sid:200013967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yournaturalcanvas.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yousee-refusion.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"youthsfororganic.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"youtube-b24.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200013971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ysrt2fsuam3ehrueluqi1kjl2m.qwo231sdx.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200013972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ytbcvd.hvdfjd.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200013973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ytcvn.ihuixny.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200013974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yted23.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ytjyhegf.byethost32.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ytrcx.wjkvash.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200013977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ytrerty-667d9.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ytrerty-667d9.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yuanghex.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yuhbf.kydugcj.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200013981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yuieopl.best"; content:"Host"; http_header; classtype:attempted-recon; sid:200013982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yuiooklo6778.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yuiqwdendsi2312.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yuryo-anzen.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"yuya.conohawing.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"ywxo.mjt.lu"; content:"Host"; http_header; classtype:attempted-recon; sid:200013987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"z1m9483-0384.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zciroternind2718.liveblog365.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zcy46pvajhl9qz.qwo231sdx.club"; content:"Host"; http_header; classtype:attempted-recon; sid:200013990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zeawzc.hyperphp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zeiron.net.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200013992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zens-bank.cf"; content:"Host"; http_header; classtype:attempted-recon; sid:200013993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zerione.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200013994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zerium.one"; content:"Host"; http_header; classtype:attempted-recon; sid:200013995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zerlon.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200013996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zetkai.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200013997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zheard.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200013998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zi0034034323.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200013999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zi992883923923.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zibosuoju.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zimb-zimbranet.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zimb-zimbranet.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zimb-zimbrareset.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zimb-zimbraserv.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zimb-zimbraserv.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zimbra-customercare.berthascholarship.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zimbra-f1a88.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zimbra03999323.fra1.digitaloceanspaces.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zimbraaa7567880.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zimbrasendingupdate.berthascholarship.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zimbraverification000000000.aitoloakarnanianews.gr"; content:"Host"; http_header; classtype:attempted-recon; sid:200014012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zimbraweb-recovery0.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zimbraweb-recovery0.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zimbraweb-srv.firebaseapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zimbraweb-srv.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zinotiger.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"znsfiwxtzwqzjlxucypy.ml"; content:"Host"; http_header; classtype:attempted-recon; sid:200014018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zojmaqb.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zonapinchinchadigital.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zonasegura.homepersonal.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200014021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zonavirtualenpinchicha.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zoran-stefanovic.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zrwsx.rf.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200014024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zudrfqsbrm.duckdns.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zuriescents.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"zxq11400office365login8824lkv.myportfolio.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/o/s!bcxisnewh_cnvrnkj_y2f1eccpwq?e=gvtbd8pbpealap_ppbzgja&amp\;at=9"; http_uri; nocase; content:"1drv.ms"; content:"Host"; http_header; classtype:attempted-recon; sid:200014028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/w/s!aqb1sjv7nuauan8etr6o4rb2z-8?e=siebms"; http_uri; nocase; content:"1drv.ms"; content:"Host"; http_header; classtype:attempted-recon; sid:200014029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/go/?www.orange.orangao.c%cd%8fo%cd%8fm%cd%8f"; http_uri; nocase; content:"20khvylyn.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bbva/592cf4/425bdbd3-91cf-4e9f-9498-7a06b3ad75ec/?test=1"; http_uri; nocase; content:"28ecne20f9u.securetnet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/6wwnqr"; http_uri; nocase; content:"2dr.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-content/themes/3rdst/8-login-form/"; http_uri; nocase; content:"3rdstreetmarket.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cxonwgkqq8reiw2ava78fudivpx5rsxjk4pzcauzfklhr.html"; http_uri; nocase; content:"4008ac56sn89rjegd23181v501edhlrnfoork47d5qkk6j01nvc7fqo.siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200014034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-includes/wauth-login-present-origin-cob/"; http_uri; nocase; content:"50in50marathonquest.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ovva/ovva10.html"; http_uri; nocase; content:"746323.selcdn.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200014036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ovva/ovva2.html"; http_uri; nocase; content:"746323.selcdn.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200014037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ovva/ovva3.html"; http_uri; nocase; content:"746323.selcdn.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200014038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ovva/ovva4.html"; http_uri; nocase; content:"746323.selcdn.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200014039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ovva/ovva5.html"; http_uri; nocase; content:"746323.selcdn.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200014040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ovva/ovva6.html"; http_uri; nocase; content:"746323.selcdn.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200014041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ovva/ovva7.html"; http_uri; nocase; content:"746323.selcdn.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200014042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ovva/ovva8.html"; http_uri; nocase; content:"746323.selcdn.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200014043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ovva/ovva9.html"; http_uri; nocase; content:"746323.selcdn.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200014044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ovva/ovva9.html?email="; http_uri; nocase; content:"746323.selcdn.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200014045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/assets/css/api.php"; http_uri; nocase; content:"99mbet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/assets/img-temp/api.php"; http_uri; nocase; content:"99mbet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/assets/js/api.php"; http_uri; nocase; content:"99mbet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/openpc/directlogin.do"; http_uri; nocase; content:"a-q-f.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/id_1ftb3gemh_1ogg?utm=abcsubmit"; http_uri; nocase; content:"abcsubmit.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/id_1ftb7k8ik_11di?utm=abcsubmit"; http_uri; nocase; content:"abcsubmit.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/servicelogin?passive=1209600&continue=https://sites.google.com/view/viewbill-bt-1/bt&followup=https://sites.google.com/view/viewbill-bt-1/bt"; http_uri; nocase; content:"accounts.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/servicelogin?service=cds&passive=1209600&continue=https://storage.cloud.google.com/1lordman1man3/oscman.html&followup=https://storage.cloud.google.com/1lordman1man3/oscman.html"; http_uri; nocase; content:"accounts.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/servicelogin?service=cds&passive=1209600&continue=https://storage.cloud.google.com/1lordman1man3/oscman2.html&followup=https://storage.cloud.google.com/1lordman1man3/oscman2.html"; http_uri; nocase; content:"accounts.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/servicelogin?service=cds&passive=1209600&continue=https://storage.cloud.google.com/appspotv450i7r8h9vf9y6yt8uiuft58f7uf5yye36u0jtyf78uuyfyy/index.html&followup=https://storage.cloud.google.com/appspotv450i7r8h9vf9y6yt8uiuft58f7uf5yye36u0jtyf78uuyfyy/index.html"; http_uri; nocase; content:"accounts.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/servicelogin?service=cds&passive=1209600&continue=https://storage.cloud.google.com/employt44to49cclrlolcrl94lnlxo.appspot.com/index.html&followup=https://storage.cloud.google.com/employt44to49cclrlolcrl94lnlxo.appspot.com/index.html"; http_uri; nocase; content:"accounts.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/servicelogin?service=cds&passive=1209600&continue=https://storage.cloud.google.com/maintainancecomponeta.appspot.com/mineindex.html&followup=https://storage.cloud.google.com/maintainancecomponeta.appspot.com/mineindex.html"; http_uri; nocase; content:"accounts.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/servicelogin?service=cds&passive=1209600&continue=https://storage.cloud.google.com/officpcpspbcncuser.appspot.com/index.htm&followup=https://storage.cloud.google.com/officpcpspbcncuser.appspot.com/index.htm"; http_uri; nocase; content:"accounts.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"acosoeu-ascaosneouu.xdwuuu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/en/bellcocreditunion/"; http_uri; nocase; content:"admin.fifoundry.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200014060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2005/03/colourful-life-of-aij.html"; http_uri; nocase; content:"aijcs.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/yonetici/newdocs/gdoccc/"; http_uri; nocase; content:"aksehirevdenevenakliyat.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/editwlink/editlynnkx.html"; http_uri; nocase; content:"ams3.digitaloceanspaces.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/freestatem/statemower.html"; http_uri; nocase; content:"ams3.digitaloceanspaces.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/igieneesani/index.html"; http_uri; nocase; content:"ams3.digitaloceanspaces.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jps/webmail_reset.htm"; http_uri; nocase; content:"anekaslot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"aoeu-aaosoauuu.yeceku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/oexchange/0.8/wrap/opengraph?url=ahr0chm6ly93zxetnmrlodiud2vilmfwcc8znzg1mje5lze1lziwmjfjdw5plmn6nto1nibbttu6ntygqu13zwjtyxn0zxi5lze1lziwmjeznzg1mjfjdw5plmn6nto1nibbttu6ntygqu13zwjtyxn0zxiznzg1mje5lze1lziwmjfjdw5plmn6nto1nibbttu6ntygqu0znzg1mjf3zwjtyxn0zxi5lze1lziwmjfjdw5plmn6nto1nibbttm3oduymtu6ntygqu13zwjtyxn0zxiznzg1mjejd2vibwfzdgvyqgn1bmkuy3o="; http_uri; nocase; content:"api.addthis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/message/c3upfo4mvzsgg1?autoload=1&amp\;app_absent=0"; http_uri; nocase; content:"api.whatsapp.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/s/x6agocx9zvj049azirk4aw3xrqdedqhl"; http_uri; nocase; content:"app.box.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/s/ymr0ltw3hmn8icxebz16gjhcyhqa49w4"; http_uri; nocase; content:"app.box.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/document/27bcdebd7736cefa2575f4f56d1439096536f544"; http_uri; nocase; content:"app.pandadoc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/p/064ca177fcb7d3b79b1a0de5fb00ade981aeff90?"; http_uri; nocase; content:"app.pandadoc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/p/26bcb52213a6d759d76014ff4e11c37cae6ae56c"; http_uri; nocase; content:"app.pandadoc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/p/27bcdebd7736cefa2575f4f56d1439096536f544"; http_uri; nocase; content:"app.pandadoc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pending/mpdnbwddws1649442630?fbclid"; http_uri; nocase; content:"app.waiverforever.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/app_redirect/redirect.aspx?id=excesscredit"; http_uri; nocase; content:"application.axisbank.co.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/confirmid.php"; http_uri; nocase; content:"apprcvryandprvcyadst.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/abg7_xbalh"; http_uri; nocase; content:"appurl.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200014079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/kektfripag"; http_uri; nocase; content:"appurl.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200014080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tryu/secure.business.bt.com/app/"; http_uri; nocase; content:"at-e.co.jp"; content:"Host"; http_header; classtype:attempted-recon; sid:200014081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/shop/v1/?vn=ctv-tfnlinkbot-pc4-cos-usr-bdl2-alt-wrl-wrle-cc1-cic-cf4-dpf&chatmessage=false&slidechat=false"; http_uri; nocase; content:"att-promotions.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/nab_step2"; http_uri; nocase; content:"autpost-fintne-au.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"azeioaz.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-includes/index.html"; http_uri; nocase; content:"baovesusonglcxt.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"baritasonte.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/optusnetwebmail"; http_uri; nocase; content:"beacons.ai"; content:"Host"; http_header; classtype:attempted-recon; sid:200014087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/serverym"; http_uri; nocase; content:"beacons.ai"; content:"Host"; http_header; classtype:attempted-recon; sid:200014088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/accedi-n26-2022"; http_uri; nocase; content:"bit.do"; content:"Host"; http_header; classtype:attempted-recon; sid:200014089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ft6dv"; http_uri; nocase; content:"bit.do"; content:"Host"; http_header; classtype:attempted-recon; sid:200014090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ft7tn"; http_uri; nocase; content:"bit.do"; content:"Host"; http_header; classtype:attempted-recon; sid:200014091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ft8xd"; http_uri; nocase; content:"bit.do"; content:"Host"; http_header; classtype:attempted-recon; sid:200014092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ft9mh?confirmations"; http_uri; nocase; content:"bit.do"; content:"Host"; http_header; classtype:attempted-recon; sid:200014093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ft9nx?confirmations"; http_uri; nocase; content:"bit.do"; content:"Host"; http_header; classtype:attempted-recon; sid:200014094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ft9pn?confirmations"; http_uri; nocase; content:"bit.do"; content:"Host"; http_header; classtype:attempted-recon; sid:200014095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fuafh#otahal@utia.cas.cz"; http_uri; nocase; content:"bit.do"; content:"Host"; http_header; classtype:attempted-recon; sid:200014096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fuasd"; http_uri; nocase; content:"bit.do"; content:"Host"; http_header; classtype:attempted-recon; sid:200014097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fuieq"; http_uri; nocase; content:"bit.do"; content:"Host"; http_header; classtype:attempted-recon; sid:200014098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/furem"; http_uri; nocase; content:"bit.do"; content:"Host"; http_header; classtype:attempted-recon; sid:200014099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/futud"; http_uri; nocase; content:"bit.do"; content:"Host"; http_header; classtype:attempted-recon; sid:200014100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fuypr"; http_uri; nocase; content:"bit.do"; content:"Host"; http_header; classtype:attempted-recon; sid:200014101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fuznb"; http_uri; nocase; content:"bit.do"; content:"Host"; http_header; classtype:attempted-recon; sid:200014102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fuzp3"; http_uri; nocase; content:"bit.do"; content:"Host"; http_header; classtype:attempted-recon; sid:200014103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/sitecxo"; http_uri; nocase; content:"bit.do"; content:"Host"; http_header; classtype:attempted-recon; sid:200014104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3ijwsm2"; http_uri; nocase; content:"bit.ly."; content:"Host"; http_header; classtype:attempted-recon; sid:200014105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2q7fcpg"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200014106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2zejaht"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200014107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/34hdmyt"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200014108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/366qkes"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200014109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/37wssuw"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200014110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/39txfq9"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200014111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3aoqym4"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200014112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3ccqacg"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200014113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3dj0r1p"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200014114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3grdybu"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200014115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3ib7job?l=www.bancofalabella.cl"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200014116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3kueruz"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200014117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3ldovbh"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200014118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3liysw6"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200014119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3nodk2b"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200014120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3pyxhfl"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200014121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3qplrme"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200014122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3ubpi3a"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200014123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3urj7gg"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200014124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3wpb5to"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200014125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3yntw4c"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200014126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3yqqglu"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200014127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/banbif-pe"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200014128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/claim-gifts"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200014129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/lmterbank"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200014130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/nabupdateonline"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200014131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/shpee_coins"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200014132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/verifikasiakunanda--2022"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200014133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/verifikasipemblokiran_id"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200014134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/winner-8888"; http_uri; nocase; content:"bit.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200014135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3g1epw3"; http_uri; nocase; content:"bitly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3jrtmmu"; http_uri; nocase; content:"bitly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a/blocked?hash=3ldwr8w&url=https%3a%2f%2fsecure.oldschool.com-login.cz%2fm%3dweblogin%2floginform.ws825%2c295%2c688%2c41525479%2c2004"; http_uri; nocase; content:"bitly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/taxirsxcy"; http_uri; nocase; content:"bitly.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/personal/accounts_blackbearcc_co_uk/_layouts/15/onedrive.aspx?id=%2fpersonal%2faccounts%5fblackbearcc%5fco%5fuk%2fdocuments%2fngb%20urgente%20substanti%c3%able%20update%20%5f%20voorstel%2epdf&amp\;parent=%2fpersonal%2faccounts%5fblackbearcc%5fco%5fuk%2fdocuments&amp\;originalpath=ahr0chm6ly9ibgfja2jlyxjjy2nvdwstbxkuc2hhcmvwb2ludc5jb20vomi6l2cvcgvyc29uywwvywnjb3vudhnfymxhy2tizwfyy2nfy29fdwsvrve5as01b19mukjbcutzeunhv3eznw9ccfbtmze3b2fsrnrgnhpzuenbvlfiqt9ydgltzt1tqjzyquroodjvzw"; http_uri; nocase; content:"blackbearcccouk-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/en/trade/now-e68_bnb"; http_uri; nocase; content:"bnbchain.org:443"; content:"Host"; http_header; classtype:attempted-recon; sid:200014141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/en/balances"; http_uri; nocase; content:"bnbchain.world"; content:"Host"; http_header; classtype:attempted-recon; sid:200014142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/en/trade/now-e68_bnb"; http_uri; nocase; content:"bnbchain.world"; content:"Host"; http_header; classtype:attempted-recon; sid:200014143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/blqa4u"; http_uri; nocase; content:"bom.so"; content:"Host"; http_header; classtype:attempted-recon; sid:200014144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?aplicar"; http_uri; nocase; content:"bonomequedoencasa.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/:w:/g/personal/dkapaon_brandeis_edu/es1enxze9_xblrutnfjfpm8bbxkssfvrpe6cnirweqaapg?e=4%3afdar13&amp\;at=9"; http_uri; nocase; content:"c569257608da4dcaafbc-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/home/payment.php"; http_uri; nocase; content:"carepath-recruitment.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200014147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f/9245db2516febd1d3c13c0a90f65c615"; http_uri; nocase; content:"cbn.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200014148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f/fa15a875fac963541c5da50d05c179ac"; http_uri; nocase; content:"cbn.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200014149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"ch-299199919900.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"chase-help-support-locked.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"chase-onlinehelp.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2021/02/blog-post_12.html"; http_uri; nocase; content:"chronopostvalidation.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/proxy/rdh-rjsrv9zzrx57iscgov74o1gka4qjdfj01qr7v8-pkjgyvn50tivt7pzqgm5kuqdmonqle3f8eq_t8f4xl6jdozabmf2lxy-888ai8hdji633rg"; http_uri; nocase; content:"ci3.googleusercontent.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/proxy/djc3ckf7jcnj8l0duyaqyjwffeskzbccy9spjiauj_jwrplgw0ahyaf1xozvm6n_fjn8q1-2vkhqqujjr1en3qej703lyxxujt6tto-ttwsl6hgsggp3ehcc"; http_uri; nocase; content:"ci4.googleusercontent.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/proxy/zjba9cvtmkfnoveyofx6gqong0kqi3s69d9o2y32fmu_gankb59tj-rb79bolx0bwbsemnonfhh2esy9olfdp-20gybztkzstfhfheqrrjuefxwiwkqws29wxm6tdobikwz-qkzfphpaldfr"; http_uri; nocase; content:"ci4.googleusercontent.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/escl6%09%09%09%09%09%20%20"; http_uri; nocase; content:"clck.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200014157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/yzuft&post=665308711_32&cc_key"; http_uri; nocase; content:"clck.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200014158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/upg1/"; http_uri; nocase; content:"cleannsmart.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?qs=6541641088c869552ced792d84ee93eabf075e23cd5eba83a7d07a40ad9cf2ce36c931984719b9df7de658999defbc87f999ec46970a0280"; http_uri; nocase; content:"click.message.fruit.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/agt12/outlook"; http_uri; nocase; content:"cognitoforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/automotive4/hrcompliancesection"; http_uri; nocase; content:"cognitoforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/knpdf/ussecuredpdfdownloader"; http_uri; nocase; content:"cognitoforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/en/"; http_uri; nocase; content:"coinmarketcal.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/h/y/b6733bec265eb698"; http_uri; nocase; content:"confirmsubscription.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/verify?id=xkgcuxugkkypkf4ypmyujtmyb2wggmhxhb3zxxo2jirasq5uwcjm0xf5bebfkersfbxkw0p0qvea1thjhtk2fv1rnmbmnpcgcmaindnk3gopej1ks2flhde2gpqylfwg4yo9k35ebiait92u9x2ztym0tdsrdwgmontpoos7x0tluwdsxbyijwql3yngtqaj5cqcm9vzfep0kuiecacy5sac2n8j38jybd2me2bhh3ik1v0dawmo4a3cqiowpzit&callbackurl=https://prod-sns-sub.collab.land/webhook/onboard/discord/v2&connectmessage=connecting%20wallet"; http_uri; nocase; content:"connect.collab-land.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200014166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/start/index.html"; http_uri; nocase; content:"coojoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-admin/network/acct/login.php"; http_uri; nocase; content:"creativecombat.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-admin/network/acct/login.php?.rand=13inboxlight.aspx?n=1774256418"; http_uri; nocase; content:"creativecombat.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-admin/network/acct/login.php?.rand=13inboxlight.aspx?n=1774256418&amp\;email=jackdavis@eureliosollutions.com&amp\;fid=1&amp\;fid=4&amp\;rand=13inboxlightaspxn.1774256418"; http_uri; nocase; content:"creativecombat.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-admin/network/acct/login.php?rand=13inboxlightaspxn.1774256418"; http_uri; nocase; content:"creativecombat.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-admin/network/acct/login.php?rand=13inboxlightaspxn.1774256418&amp\;"; http_uri; nocase; content:"creativecombat.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-admin/network/acct/login.php?rand=13inboxlightaspxn.1774256418&amp\;amp"; http_uri; nocase; content:"creativecombat.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-admin/network/acct/login.php?rand=13inboxlightaspxn.1774256418&amp\;ampopensource:observable-35835700-0d08-4c25-a188-b8312ba00a941067515"; http_uri; nocase; content:"creativecombat.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-admin/network/acct/login.php?rand=13inboxlightaspxn.1774256418&amp\;fid.4.1252899642&amp\;fid=1&amp\;fav.1&amp\;rand.13inboxlight.aspxn.1774256418&amp\;fid.1252899642&amp\;fid.1&amp\;fav.1&amp\;email=&amp\;.rand=13inboxlight.aspx?n=1774256418&amp\;fid=4"; http_uri; nocase; content:"creativecombat.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-admin/network/acct/login.php?rand=13inboxlightaspxn.1774256418&amp\;fid.4.1252899642&amp\;fid=4&amp\;fav.1&amp\;rand.13inboxlight.aspxn.1774256418&amp\;fid.1252899642&amp\;fid.1&amp\;email=jsmith@imaphost.com&amp\;.rand=13inboxlight.aspx?n=1774256418"; http_uri; nocase; content:"creativecombat.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-admin/network/acct?email=jackdavis@eureliosollutions.com"; http_uri; nocase; content:"creativecombat.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-includes/images/verify/update/y.html"; http_uri; nocase; content:"creativeingredient.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2011/02/habbo-crediti-gratis-sicuro-100.html"; http_uri; nocase; content:"creditiperhabbogratissicuro100.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/:o:/p/clord/eo0lfhtannnjiehfwx2q5o8b_lkpqdhacft8rkvqad2nqg?e=5%3aq65oiu&amp\;at=9"; http_uri; nocase; content:"curtislibrary-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"cusstomerservicee.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ebvdr"; http_uri; nocase; content:"cutt.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200014182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/secure7a/"; http_uri; nocase; content:"cycelant.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/webmail-rd1278/index.html"; http_uri; nocase; content:"danashaymarketing.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?d#wallets"; http_uri; nocase; content:"dapp.accessactivationbot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/#abuse@optusnet.com.au"; http_uri; nocase; content:"dawn-shadow-6508.on.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200014186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uploads/team/zxc.php"; http_uri; nocase; content:"demo.mobileappformyrestaurant.co.uk"; content:"Host"; http_header; classtype:attempted-recon; sid:200014187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eventpubgm/eventxsuit"; http_uri; nocase; content:"desty.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200014188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/online/showdocument?documentid=1fce937a-ba39-4053-a83a-f07711ad8efd&invitationid=82f3e840-cd11-4da4-8579-304bd7e930b0"; http_uri; nocase; content:"digisigner.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7p8ma?confirmation"; http_uri; nocase; content:"dik.si"; content:"Host"; http_header; classtype:attempted-recon; sid:200014190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dirbn"; http_uri; nocase; content:"dik.si"; content:"Host"; http_header; classtype:attempted-recon; sid:200014191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/iavat"; http_uri; nocase; content:"dik.si"; content:"Host"; http_header; classtype:attempted-recon; sid:200014192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ot6v7?confirmation"; http_uri; nocase; content:"dik.si"; content:"Host"; http_header; classtype:attempted-recon; sid:200014193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tpjda?confirmation"; http_uri; nocase; content:"dik.si"; content:"Host"; http_header; classtype:attempted-recon; sid:200014194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/w9smu"; http_uri; nocase; content:"dik.si"; content:"Host"; http_header; classtype:attempted-recon; sid:200014195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/14038722/"; http_uri; nocase; content:"direct.lc.chat"; content:"Host"; http_header; classtype:attempted-recon; sid:200014196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/client/index.php"; http_uri; nocase; content:"direct.smbc.co.jp.xklytt.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/reg"; http_uri; nocase; content:"discordgift.com.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200014198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?url=https%3a%2f%2fpushrushed88.duckdns.org%2fredirect%2f&key=ulc_4epigzz16uwfb5b_yg"; http_uri; nocase; content:"disq.us"; content:"Host"; http_header; classtype:attempted-recon; sid:200014199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/paymydoctor-at-www-paymydoctor-com/"; http_uri; nocase; content:"districtchronicles.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/document/d/e/2pacx-1vszcwxk6nifthkg32wjxfjgq9yc-jjujkbsumqeeau8uw7xkcutyp0tbgux2mvwu8iqfrxxlunajob8/pub"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/document/d/e/2pacx-1vt_xl-m0ff8yqqhzhgseahgwejo0znh9re6w0qvgbe0qfe084hrebjjg673htphdnvbcdnq6agehncq/pub?mobilelogin"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/document/d/e/2pacx-1vth3iya0ov7p49rk9ejozgqnueuk8fna2mky389hertlwx4mnoyhl1mlhnwbz8sxnsqtk8i5uysmq68/pub?embedded=true"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/18tk5qmpccb5nygfkfeo9xc5qowvffgdjvy52swoyhd8/viewform?edit_requested=true"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/1aegowsjpbld0rvgivurbyfidcqlg5v7z9i9ylo3bey4"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/1aegowsjpbld0rvgivurbyfidcqlg5v7z9i9ylo3bey4/viewform?edit_requested=true"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/1gs07chp1nmdlfpzzgcswjfzjtek057wtnfs8ws_jbky/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/1htjqwgpnkonvm8dbgasjax8mkpu_pvnj0c71ttkfpn4/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsc-nv7qlz6jg_y9ze5k9ds_kzo8hyelurb5j5veve1q4jkiwq/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsc-xysogohjsbzmcnoded8ooar2gz1c5zxobgk8envh3jbpow/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsc0yyqlieizg0nzouznvhsjfags1h9qi5hpdw3qlgbivm501q/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsc4bagzjzmstbnjhy7zpy5zsx-xrn7reoouolv54luk5tihha/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsc8uc5aztlek3s6dqtk1etorhez5m2yvubyw5qmfkpisrelcq/viewform?usp=pp_url"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsc_enqwhhv1jnvzy55mb4ghvjd4wcz9plnolh2eoitk7qgbra/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsc_f0pxmnwzrtbck6u06fdzocmhgzvjzlc8cu7c9b456fhccq/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscaoiohhbm7suyz9ol9o9ueunbxn6donxrfjge2cevdw_8jmw/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscbpunbcb6ubfnwjo9jol26cjvjjsvpzkz_wb9exxt9c7erdq/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscbtba5srjedev4uvqq49pt3recywqah-ar5szplndj-dxhgw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscc98m5fw4ifog0zeiuquxitizmisrgsdvyxvtxsppunpkwzq/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscclmqirehqtkm3vl4u9gm2zv6xfvrddbrgke9fmsfujqbboq/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscd8t8sjgxqrsa6dq5kjpmrpsxkvi4bl38sfdu7wa3sl32elg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscda1to5ru4sjeeujg3ki2bimklprvsec6u43kpvhbfyhrldw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscda1to5ru4sjeeujg3ki2bimklprvsec6u43kpvhbfyhrldw/viewform?usp=sf_link"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscdct8mue2qq3syjr4tnntol30jfdk8vwpco6yjh7dxnq5nyg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscdct8mue2qq3syjr4tnntol30jfdk8vwpco6yjh7dxnq5nyg/viewform?usp=sf_link"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsceoxsfawdsbd2r-jk2sppywnv1bchzjjcw2xkcj7oqkwqriw/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscf9u8nrld-zvu6clr4jcwnw0buqrykdldtzoullbxy8kc1ta/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscfh2njwrve6_rkxxy1yz83keoeekd4maqcnd-ivq7rkg0uca/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscirilop6_iti0zvvrlsbk8zfaeo-f10otlhj9k5liyervk4g/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscjsewetq_v_cbpyh9dzjwsaoldxz2zx816022wp1vej8gv1g/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscjtat4fmstlxz3hbfkg4qyi-epfdmun7_avcqwvgscoydytw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscjvnhykksssaw-kycyrl6ywg_r3fdjuyqhk2mrmxcpgwfxoa/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscmzyecgbuuccfs_5e5axn9hpruzskqmvseedm0xz1qrqb5vg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscn6xxq_xvtivggy_4rkibou1i27e0kpiimikafpaavki1vsq/viewform?usp=send_form&usp=embed_facebook"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscndiqyfu0gtgwomcwsy-8nadvzgljrpdhkv6pedgh0avniag/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscqbbsvkpxnasqgeazpzwxp1ln7qzdurt-nqn4azqa7q14euw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscrmsgjymaojts0bfneswvnfekiw6zya5rzyqoa1ydp5wkcrw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsctmueyv-hoo8lvwjhptfnaht4ymn8cr3tnftbfnqmjb6xpwg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscuttypbph1iazuis8aa6xvrlmagwglmdcrrg8g2oymskvbva/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscvqmhqgwbubzxdynzgvlbmmziyagdiadz2eyhc-s-ro8ndfq/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscx4rzk9ikl26be_kioaexwmoava7wqjpstcbt-_qjv8klmsq/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscxgbsqs0_gphf4vziykyu_g5rgytw2s9fir3lyfar7kaixew/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscxgbsqs0_gphf4vziykyu_g5rgytw2s9fir3lyfar7kaixew/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscxktatyielmhqxqqxtesa1ih5armwcrqy5r9-95cslplt5rg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscy0frglrf-omcz0vkzncs5vnnwg-sbnzhqxv7fhse6pfwf7w/viewform?usp=sf_link"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlscz4uf8dtvwhgxggkzsbbhjcgu9npgc6agxpy5o2fwpo6tv5q/viewform?usp=sf_link"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsczswa80hlvnpkqiuayjwbf8ha_rqzov0iiz18iixjatmqk9g/viewform?usp=pp_url"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsd-bdmru2lv7bv1fk1mwwkxyrvf6uyx11zlly9k0j2gdse_rw/viewform?usp=pp_url"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsd26pifmynauv34el3gdnx3yzwdue9bannzsfcy7bdkyfotaq/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsd3x6brnru3toiionptordwmc4zorxcky1ebpmeg6bb4jfuca/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsd5a68ino7qnojzidjg3eemyspl_vscjc06rtn1yjqnrewj9q/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsd7jgegqudsjg7blscqgfvdftyvlno6xreg6wjuxl0hnfbwtw/viewform?vc=0&amp\;c=0&amp\;w=1&amp\;flr=0&amp\;gxids=7628"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsd8vkw5fxeroe_pxa7n5cdfpukhahbg_7k7sg0iuosh_xsyoa/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsd9poeb_wmgffgg8taw4z_np0kdbo32gr35k1zxizj7lcdela/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsd_c4wpt0zzouwt5lr9p5kn5cylz3ananv1hlix6u_h36w1rg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsda4flfi-1_gvwqnbb1dcxz_mb5omo9t2oc-vslzfgh6avrag/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdbgprbyowwcugqslasnoo-sbqcrgi6ppycsytvsw2_dwfeug/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdce9c1bqexlzlu9rojtuwtaatyeeshywbkmuiobrw_a-_mga/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdce9c1bqexlzlu9rojtuwtaatyeeshywbkmuiobrw_a-_mga/viewform?usp=pp_url"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdcga7ojllxp3z9puyfumhvn7klcijhty86bmhawtv5r6wwqg/viewform?usp=pp_url"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdcznggxnwia2ct8kmxid1tdqhgerhnmixukxuj7nmq1lqsma/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdf04avkjwvete8rj-wa3i7u6_8-orwqu-c-owvgb0nrxumga/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdfarxg-0eurkyimsg-ukgl4mbtgvwfhe1wzbdxmb7oaosnyg/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdfyxb1kjjvkaiwbbpbgr0dfaq1xx2ehhzbxnt3adndssy1yw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdfyxb1kjjvkaiwbbpbgr0dfaq1xx2ehhzbxnt3adndssy1yw/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdinjm_qvdbv3roybqi073rm1pujmrrs7lid7c3qk-4xwweew/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdjmguhf2gu58xprr02lay_fc7kwixkq5zmtsn-5rgblqhbiw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdlu7aleidehwfklicwf4z87c6ecpksgjeidm5sjdwycxizmg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdmjjljjfmjeijeyraxfm6pzupdbvoie7d_ussaqgqu2jh7zq/viewform?usp=pp_url"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdmsww4edj2yofwdenmvl3uvyibigishgajtsfa7chvcan0wg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdmsww4edj2yofwdenmvl3uvyibigishgajtsfa7chvcan0wg/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdnega_6c_pz9_q9ep9epm4iwqfsrxqsnaz-j9dyldimaoocg/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdplfokrnpmrpcrkjrxtvb7hv0nyzfocaudzkgzrftfbumaiw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdplfokrnpmrpcrkjrxtvb7hv0nyzfocaudzkgzrftfbumaiw/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdrk4xndjat7qhzawgsc96chkgkg66dcwrujwfkgjhzkmzhqg/viewform?usp=pp_url"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdvwkczn_rxvn1522z1mcojbs40ymrctyizpyuv72_0wbypgq/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdwbz5hapgqojwjyndeeyjxamg0wnaj3kolh3fb6xf4c-fxjw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdwbz5hapgqojwjyndeeyjxamg0wnaj3kolh3fb6xf4c-fxjw/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdxm-rwnv41p3wdcbtetukrctoakvuoe1h_uy8jgnxy7kldza/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdxupqc45v5krv3e0skzu03cm214ktma588b8afg1stpesclw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdxupqc45v5krv3e0skzu03cm214ktma588b8afg1stpesclw/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdy1071rbhheyidjzo6fw5busqot5eunllw_thawo6udamfaq/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdybqflfptobqslhflytic3g936bnojaljztk6ct1d5mjvnnw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsdzrubbm3nrqdzjs6q7phutjgmn-dm8zquphjg9ge31q7bdhg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlse3-zgmg83lctfks0egmambwonybkscrvxix--n1azwngkphg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlse5htthgifmniezokiypnjjhanvkvlehsrk9esgcpoauqutiw/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlse8ds15kxxdcrhfspcfrbvy6sbdhp0e4540zzmhhvzouewvka/viewform?vc=0&c=0&w=1&flr=0&usp=mail_form_link"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlse_mo9pzgdahzdgz0wctr7lm0cqm_zwos8ljc4cqgtvnqfmfq/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsebpakzyvtprhygwe23jlsdieyoca0jtiyy-f68nqwofparww/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsebyedalhc7exqq5fljf8x1akbwz0h8l8ojbx5nx3go7bh3sa/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsebyedalhc7exqq5fljf8x1akbwz0h8l8ojbx5nx3go7bh3sa/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsecilc_5ka58gxqjfrpwbfwmhykkdly-lwm9yubx1l1gwzgpg/viewform?usp=sf_link"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlseck8-g3um70ihw-ajfait5whcec3qdowobizswz8_-et_jkq/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsecl3bk58g9ucirun7tsjpfkkkeryur6xaryenk613tqzqfxg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsedam8qavfd7nwszgyriuofus5xlgrvwcojm_8jtzpiw9ud_q/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsedg-b07st85voaknpclg88z_zybaqffowcrxa-6eq1hemokg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlseghb19gxs04xdkab1cubu6qmclhh_rpb2fwa8nwutpbwnkba/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsegnx2irh_r_gtlspwo66pv4vkht2oobqmvjtvs4yqjj6vr7q/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlseht4cdltkad8967jjarcb5nafonbaw3dtpynth9mdk94hf-q/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsehwehncrhloyw72aebvvzvvzjrs6yz6qphpm1dvobyr8rnig/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlseirld9oyigwxmec2bc-ax4yd-m-rhezlne00aminsjf0uteq/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsejavlqdkikylynqlg6p7kyfu4qnlyy31opnfttucuhgmek4a/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsejzzt0w_l58kpcmcq1bseqi53i0retcnl0a1-uldxvnyz-ka/viewform?usp=pp_url"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsel8uq3oplbpuz97bjyv7s-6wdghzjiaiauioimsb9buzjfuw/viewform?usp=pp_url"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsemwyrvcln1ql8uxd0dsiswveuehikz5hwalfeni7jjfaefmg/viewform?usp=sf_link"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlseoz9zpmm0c0fjksklv-p1hsrwsuybmj6bvbd_fkewzzcv_ea/viewform?usp=pp_url"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsepe4jevfm3mjc-vndxuq_9wjpc7afrjadkxvp8czawh27cqg/viewform?usp=sf_link"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlseq5h3-5stw3bwnpoi6g-gfwcgej7q82incdm01dd1lf182iq/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlseqdx2wgybdxlhascsuopq1xqsmwrxjf4erl_cpmvtt96dq_g/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlser-b6q--nvif2fj7nbn88dh8lj-s2yfbgjyuygwsacbhm6lw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlserwgqm-czpabole0qw-jg4bhicctqdjm3ex3v4vzifj5wldw/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlseszgantjzuxgteg0dsiizzmadcwjbjqcsri5nidod2rd2_lg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlset42bzecl3yrdnnffv6f7kecxpd1sy4rbh3h3govwg1k1z1w/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlseumxp-wga1x873upqxmi_hx8nbbllh12zzmxia1xuqp2mgbq/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsevpkt1byhl-oqjptw8wbecnm7-iqnax-mz8zd-mxp0fol3jg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsewr7-ksdpydhc1tv8tkcxrlad8zrf3q_uqt-rj9a_fmmzxya/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsewr7-ksdpydhc1tv8tkcxrlad8zrf3q_uqt-rj9a_fmmzxya/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsezbbqgms0nnvgk6aq0xz8sa19zyd8w87c8js99mpi3go1mqg/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsezxizhvg-i28_n8fyddanndnufw9veep4kk934yekxvxdmdw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsf-exsf9vm0rleksdp46wa2dfca3dhphayf4tl4rktjvmgguw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsf0appdcwb17-g15hxqlvwdz2cngcp90uuisclz55s2volujg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsf32hx6ujsi_gqji38udpamxxxnhyrx8qhmqcqnteinj_0cmg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsf37osr6zds7tctpiqseyyoqpqnzaeyv704aye3atqnyhd4-a/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfacaqo8c7hsu7mr6zkbsfulv8m710ke2qna_7tyusomgmtjw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfacaqo8c7hsu7mr6zkbsfulv8m710ke2qna_7tyusomgmtjw/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfaekglhjlubx-j0s40wtk-dntowamok2u3dl24wdxhni6cuw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfdy4lqz9cxxc2z-9qldm8asxoikrw5w_jb9d0iciiyy_bpbq/viewform?usp=pp_url"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfe2ymhbjhlp2njbhcnyypkh2q_svr-hjv6jakyhkrcvnrfhw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfeoy_w3jwkkz8psgsw4nrja9tmg2lx0x0nvtmv38k0hjzzmq/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfesajj9-epeg0p0pdzfaf3xooefbwmwsn2jne-6doh86mocg/viewform?usp=pp_url"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfetregzccisehncfk6344jq5ab3iq6ft0a6k_v156sh5j24g/viewform?usp=pp_url"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfjchag9rs_yczr5hheyuc70ukrtaonxwdhxso7_qhcpp04lq/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfjpx-sxpejnp_q2fmfu0jy8oqoesrx9wbrqplcychw9luupa/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfjsgjhbjke-mlmni8cfg1tacz-hdpvmy5j2br9upjr1f7nda/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfjsgjhbjke-mlmni8cfg1tacz-hdpvmy5j2br9upjr1f7nda/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfk9hpkld9-qwaxs8b0cpslaw2-oomu6bcwpxkmp-fo8kr3ew/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfksirdejkit-tdeiwrnkf00ygsqdsqth0hmwydiqdik10tna/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfmppmwkaythtoskrsm7wewzrcamfxbeyuc6f1ewjjmzisfwq/viewform?usp=pp_url"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfnjyzbmw-pd1byw4b4opoksx2cealounsnhg5fjc3fk1qocq/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfnlsbejsiacubkj2geltmn7slefoweeczuagp3jfmfkijg4a/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfp1eukgsktriyraz2csynqwfwtv6ehlnbszu69dbxz9lirtq/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfp1eukgsktriyraz2csynqwfwtv6ehlnbszu69dbxz9lirtq/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfqf7_zc-bsb7ej4d_rikrhb3bi-o15o1l1lsa-dw0nr-pztg/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfrw9nsla2lpenbntfmz3q_bu-6vayjudjntqikzcei2rl3ya/viewform?usp=send_form"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfrzt6zpkhgtvzqutkypqtjffxaucn3evqpf6ytbqug3t41yw/viewform?usp=pp_urlorganization"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfsia_g4fb5yg_cu8fjuxcndbgqz1setzfedm0cw0eaonb57g/viewform?usp=sf_link"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsftriyys-rvphnbmh6v6lyimxjy3rpog8xvtb3v1agqhawiva/viewform?usp=sf_link"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfwdsuczwrih_wnciwh_qjpg1v5p-qk8zyjjoccpbhmyeygrq/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfycsphkkxmvj-t66ndwyxgmrpwcfggdbntzzcy39x4mvn50q/viewform?usp=sf_link"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/d/e/1faipqlsfzhyjvw1nn6bvqhbwmd3rcrm6gukuzir5u9tmsszmcrr8nyw/viewform"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vq5dr7ajdkfwicg5n2lbhbfo85bwvgageeqmuvllkwg5i2iuhekmsvmwotev1nnzoy8xasnxerngqew/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vq7oplr_-m2wcmmli5bewiwc-vkkblykry1ejy1vfvkm6c-yanjplkligavkr2dt8vkw6dmpyzkp_ki/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vqfy0klc7lmimfug7xrvape2jdz8153ptionyg7ht7va1ggm5loptsqunpgtiwn36i9y8ggrat6f7ka/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vqljiqoxuypxg7a8r5x7frbq4cqcvnb77n155fzyxweegqibwjyjnpghjky3howsxyb0pe3g2wm_xpm/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vqo0xukh2wuts-r_jah5nfa3jsnxxdkgvfcafnigv47ptitu24xoqtt_fhtwbm1p6wpz5ajydo3ho9-/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vqopq9v2asclxkhw1tgkr3v1no0smckg8as4x6t4cyhuszvfjkaosxhp2phofsyb8ag0f-anei4kzqb/pub?start=false&loop=false&delayms=3000&slide=id.p"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vqu0o1dqub-kv03p4gy0ejbnihzagkeygkrtg_pjalszgnx2akicmii3q_yddp09xcvywtb_e6mqniw/pub?start=false&loop=false&delayms=3000&slide=id.p"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vqx_zel_kuemn6sejjmr951m_x6bzzai7iqp25hfj909xoffbtw822kfnfdpl4uarmqcjov-ztc9m0l/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vqywoq-kea3q3xkdnwfqqdxg368izvbbqutcjaxpy3t8duksihqmnqm70qvpl0oox5l-ijx6srgpgrz/pub?start=false&loop=false&delayms=3000&slide=id.p"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vr6tvzu4mhovykztgbizpvk0dyqvofyblwizyequq3kz1yulxyyzuee4nlqqb7_pqgittaxzkcw7ul0/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vrgv40o-9hv-h-te58y7dluzlgkiq2lgps9rphybq5nrrnwau-nlsnedjuazhprry10otfrh3_iq1tp/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vriyg_oiukpuguzpg2epbnyy4qjmk1v3maunksjuumfujoeerubxylo9_hltssk-qv7jsrfqfppdcgn/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vrl1ylbscadiuntrkeq5xe_bz5zwgfjgao5atkkbeidhn_aqqyspym3hagxsqckazae7pwdwtgkfkvg/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vrndlzd4qdrc7kjcsjuzzmrrr2jdhcja_8bqfaromkv4gc0xzecwkk64xdd0cqcypwk3_s_2plp8wtv/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vrp2k-b45tcwcadgwzkulyaqrs1f9vfjs3y19o6fs_7p34ymzwuascr7lkuijhc83-o6fmsbbvehcf2/pub#slide=id.p"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vrp2k-b45tcwcadgwzkulyaqrs1f9vfjs3y19o6fs_7p34ymzwuascr7lkuijhc83-o6fmsbbvehcf2/pub?start=false&amp\;loop=false&amp\;delayms=3000&amp\;slide=id.p"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vrrbkktbsjl0p2tdhjzjo2uawkvwbwipzqv2sgbcl7xpkns2l-hixlz_bwi0cstwntvcxq1a5r1lj4x/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vrriatvgvtaoki3lje5es155asdvvgmqqjoosenskwwiutrtwubnfwgosjeuupxd5oda3gx6hbdaslk/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vrtqnkpg6iuhiebu4jsuo7uchiwlv8o_t04w9wo9jasacamr0f7xllpl0kwgfcjxx04beg50ddbbwf2/pub?start=false"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vs3tzy7hkkj_csrhj3gdjz1ran_zcnq6xpypttgyznz3bzgnxj9xyrngmqizegktinhkxwtjzmsoepj/pub"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vs4t3osol5-a2tlqhpxcbnoykx-v0xpvbkex3ikocawxpr1jez_fqk0zq8ylq7w8_4du3b3z57qhj9r/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vscnp2olkt7sdim_7ngfmuhpbc_fvqmxsn4q50ynjpimjzdrkx0bkzoilywqpykl2zgdb_sh6pickh7/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vsgw9oh1ixw4dhkvxkwxlwsu7de-mla1kkntrqmjmqiy0zicd42e_8eakt3kiywvfk0vrfexpkcjlmb/pub?start=false&loop=false&delayms=3000&slide=id.p"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vskgwhr2flv0fouv_mac13jdyp5a-drx8tnnnd4soc852jjodbgozj44z7_9v5_0xlktsc10xy93zgm/pub?start=false&loop=false&delayms=3000&slide=id.p"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vslpj7pk4-axbccjqtpblesxanwetmsmefuchs2sloxncmvllwzftu83w_w_uia1mjemn717hwpcfnq/pub?start=false&loop=false&delayms=3000&slide=id.p"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vspnbijel3trkgiucqlxf7ozncbv8afgi8spwy1we3rmyp_degyrb8lt2euqyscu25c3ow_qsaa4qqd/pub?start=false&loop=false&delayms=3000&slide=id.p"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vssxayagcehnojap_9vi4vkx2fwqtkzpgwviy2j2efosj2xfmvqmsyv1avj3eclx5wb22joceezc8t0/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vstqki4nnnyrhsn5l0tj0ec7y31bzuyy4tndmtidtdxtpbnwjjrb1nj5rjx_04hmctvvf5iu4yxhjx8/pub?start=false&loop=false&delayms=3000&slide=id.p"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vsx8ahrvwaowtfdbywictcemrz6z1wlqenjtp97v184yas9irqjz2-axi0yov-zb9yo2o5rwe4c50hi/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vsxb67fpjaihbdxpjzezitdle1dyad9ms5ofutogastaz6xviiyomvznksggemtex4mqmwz2gaaylj4/pub?start=false"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vsyhwcm0mdnj7ukwpqxw9t5pxb0pfavupv6xzq2qzdaynme4dlvf_x6zipvbvs8apohuptxvz-pqodb/pub"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vsyjh3oqjp_mkyqdaub6tdi-r0ern7crtrrkktdqq6uzvearmeidpgrwvued9lf7jirwkvoi8s63qn2/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vszmxwf77cx9jec22hwonfd-l1fnnca3x407pvkw3_aanghjmyvustququfenxznzckxgaszizaop76/pub?start=false&loop=false&delayms=3000&slide=id.p"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vtejvm_urscgm4l2fhqauhj3zbgy2efdrqan3jfelqosuqbmhodxzjfc9mezdezg3lbhe95behy6now/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/presentation/d/e/2pacx-1vtwkjwy3_-kl8f5w9p6a1topb1ob0r15tijqhclejlxmwtsicqxiktafoxdxkehh4tlvfye7c6xs3og/pub?start=false&loop=false&delayms=3000"; http_uri; nocase; content:"docs.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c/ejxnt9lowzaq_jr6jcpxnoqhdxrkjuoliccol2ptr9v0ciljcotrcsuqskvv7mh2zuejdfu-a4prxlbl22l1dknw5fpnfzcu_rjhgwekqtjlneqau5upway0l1src1eaiajqyijpdob7mlfpprymhxgltjvtj5fsk0bdrdgsmiw1fe4jlihthiuzz8wuponxscag6anwd2facqi2mxb9rjxp-fuq6lo_vdmee5sm4yg-pperbxtgorogbj6vnleuseckmmzebgavykymacmgfdpc6c9t4sdzvnawzi5vc13pd_olrcwfkvcbdq36frthtokmde1eo8hvk_l0bbkrx_uzcggtyv5d-tt-7stge9p_ojbyisrxjbqdwywur3djrtrunvxyt5s2e9d3y-2c06ufis_wugkpslplrcks_wyb8jdm"; http_uri; nocase; content:"docs.transactional.pandadoc.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200014386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/3a5r5a92ssx38jsi"; http_uri; nocase; content:"docsend.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/7kbaanzkgswcge6a"; http_uri; nocase; content:"docsend.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/nam/0a1c53e5-47b0-4dd4-b77c-2e3bbbd05b5f/4160ae10-d8cf-4147-87cd-1550ddcf3a37/c2081268-0edb-41ac-aeab-779aa0b18f66/login?id=uk4vmkxumddrmxpxue9jl2zwmlywzmvzq1bgaevpl2fizflkb1p3tkvynvnzttdhvwhcl1bxr1v6nkfirkfloxfieg1mtehtchn6yxhvmnfjnvzunvvvbljctjh0qtq0bnbfsfb2bklrbgpjrky0ctczbtnsrjg0anazre5vwtvsa000ahvwchhpk0yznulnvzg2zmjkwxq4qlptd05oz2czzvzjwvh4ym9guk1rv3i3m1z1ymkxs254rkrlbku5anqxsutvt2zybwrxqxpqb25mczm2seq4tstetzr6b3bwzjniyxrorytbtgkrrlnqyu5ybnvwevrnzgcxk2ntdkhnbjfnbhvorhc0wjfmcgfod3lmvfz3twxlu0z5mi9mowpmagnomwxvsm03yjbmsjnyajewvkj2dtbwbu1bcetbvfjxbexkbvrfngt3ajbnauw0yvnur3bztwoxmhhkl0toukjcovryunp3pq"; http_uri; nocase; content:"doctricant.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"doufatin.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/file/d/19zpw90jgon3j5merxi1pauvkjdmx8nfq/edit"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/file/d/1bcdyitw2vo5jp6yrbdmiy8cfrkcf4tby/view?usp=drive_web"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/file/d/1c5o9_y8_octsepwyojfarn1k-kj4d9fe"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/file/d/1fdgs5g6fqqkudcl2meym63ua3yu0o-tb/view?usp=drive_web"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/file/d/1fsvmjkcq7ennrsfdufkcxshfhnda_fui/view"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/file/d/1ginbnlpvt7kpfnog9a68fqmn7k3aivui"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/file/d/1hdvx7j89h5l7yz39idgzhqji93jnkl_c/view"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/file/d/1jixb69t_nw9tmkhvfrejkfzof3d-ijet/view"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/file/d/1qf58h-1lunq1pubplwdhwd3uooj_vjxa/view"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/file/d/1robiosanbh8doqa7yuiewn3akz4094ho/edit"; http_uri; nocase; content:"drive.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-content/aruba.it/aruba.webmail/arubaredirecti.php"; http_uri; nocase; content:"duobabiji.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/#redacted@abuse.ionos.com"; http_uri; nocase; content:"dyspbtkieafxkrkt-dot-ali1p-t1lop.ue.r.appspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?ref=agfuc2pvzxjnc0bnbxguzgu"; http_uri; nocase; content:"dyuvstyfawecteraw.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/owa/auth/logon.aspx?replacecurrent=1&amp\;url=https%3a%2f%2feast.exch082.serverdata.net%2fowa"; http_uri; nocase; content:"east.exch082.serverdata.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200014404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"ect-maeiesseoicoi.bhzzeu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"ect-maesisesoeiccoi.hhokau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/personal/marco_eeverywhere_com/_layouts/15/onedrive.aspx?id=/personal/marco_eeverywhere_com/documents/documents&amp\;originalpath=ahr0chm6ly9lzxzlcnl3agvyzs1tes5zagfyzxbvaw50lmnvbs86zjovcc9tyxjjby9fcwhvbeq1x3hltknorzbdmdvvmgjvvujoy1z3b25futjvejhtlwxqrg9svwvrp3j0aw1lpvduaunytfu4mlvn"; http_uri; nocase; content:"eeverywhere-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/doc.html#test@test.com"; http_uri; nocase; content:"efax25042022-webapps1-1311433986.cos.ap-chengdu.myqcloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m&#61\;0"; http_uri; nocase; content:"eleoelswka.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?url=https%3a%2f%2ftilbakebetalin.wpengine.com%2fsw%2flog%2f&data=04%7c01%7c%7c11af7bbcb8534b33863408d9e17cff46%7c84df9e7fe9f640afb435aaaaaaaaaaaa%7c1%7c0%7c637788749239190942%7cunknown%7ctwfpbgzsb3d8eyjwijoimc4wljawmdailcjqijoiv2lumziilcjbtii6ik1hawwilcjxvci6mn0%3d%7c3000&sdata=wyye%2fyjymouztvtdzw%2bfpfpyzj4nrvzhvloufqhq128%3d&reserved=0"; http_uri; nocase; content:"emea01.safelinks.protection.outlook.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/redirecionamento/1ge44"; http_uri; nocase; content:"encurtador.dev"; content:"Host"; http_header; classtype:attempted-recon; sid:200014411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"eneeeetsowww.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/:x:/r/personal/nradonich_ersfilter_com/_layouts/15/wopiframe.aspx?guestaccesstoken=t6t%2fhn1dkbyhlyx%2beimbazufa43rrgz6%2faaaewnocdi%3d&docid=1_18168db23429e45f29fdf2e7be120efc4&wdformid=%7bb9970f62%2d44c3%2d4d09%2d9929%2d6e1eb652da57%7d&action=formsubmit"; http_uri; nocase; content:"ersfilter-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/personal/nradonich_ersfilter_com/_layouts/15/wopiframe.aspx?guestaccesstoken=6ywmlbqi9%20sjfgzhadhvte2gyowjf83iqbjrjehik4s=&amp\;docid=1_135f7008dfbfa44e6b09dab0eb165b997&amp\;wdformid={e037f2d9-5daa-4916-ba03-eb11d0aa6dea}&amp\;action=formsubmit"; http_uri; nocase; content:"ersfilter-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/personal/nradonich_ersfilter_com/_layouts/15/wopiframe.aspx?guestaccesstoken=6ywmlbqi9%2bsjfgzhadhvte2gyowjf83iqbjrjehik4s%3d&docid=1_135f7008dfbfa44e6b09dab0eb165b997&wdformid=%7be037f2d9%2d5daa%2d4916%2dba03%2deb11d0aa6dea%7d&action=formsubmit"; http_uri; nocase; content:"ersfilter-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v1/app/gbwa/image/transformer/4573be1d04074ebfab8fbb16f21a65de"; http_uri; nocase; content:"esa.www.wamodshost.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/17369aa91d5549c192b0f736d5822403:rr-frontpage/index.html"; http_uri; nocase; content:"eu2.contabostorage.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/shard/s339/client/snv?noteguid=f48e12fd-48da-e57f-8e76-cdf6e4054e1d&amp\;notekey=02a9fa6bd051dc6b4581ee3b617b3f88&amp\;sn=https://www.evernote.com/shard/s339/sh/f48e12fd-48da-e57f-8e76-cdf6e4054e1d/02a9fa6bd051dc6b4581ee3b617b3f88&amp\;title=optus%20webmail"; http_uri; nocase; content:"evernote.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/shard/s446/client/snv?noteguid=4dc119ab-57d6-b8e0-4fcb-c11c0a637b94&notekey=9ddb3753cb700b0c86a78176be71f4f5&sn=https%3a%2f%2fwww.evernote.com%2fshard%2fs446%2fsh%2f4dc119ab-57d6-b8e0-4fcb-c11c0a637b94%2f9ddb3753cb700b0c86a78176be71f4f5&title=you%2bhave%2breceived%2ban%2binvoice."; http_uri; nocase; content:"evernote.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/shard/s446/sh/4dc119ab-57d6-b8e0-4fcb-c11c0a637b94/9ddb3753cb700b0c86a78176be71f4f5"; http_uri; nocase; content:"evernote.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/personal/tim_hansen_excelelectrical_com/_layouts/15/onedrive.aspx?id=/personal/tim_hansen_excelelectrical_com/documents/open%20to%20view%20shared%20document%20in%20hitech%20sharepoint&amp\;originalpath=ahr0chm6ly9legnlbgvszwn0cmljywwwlw15lnnoyxjlcg9pbnquy29tlzpmoi9nl3blcnnvbmfsl3rpbv9oyw5zzw5fzxhjzwxlbgvjdhjpy2fsx2nvbs9fa2zoazdydndfaettvl9pwulkctdzmejlveeyr3awzwjnsdfkrgdjrfdfttznp3j0aw1lpunrvevzrwxcmlvn"; http_uri; nocase; content:"excelelectrical0-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/r?us_privacy=&amp\;a=p-w_ayumw3pzr2w&amp\;labels=_qc.clk,_click.adserver.rtb,_click.rand.60541&amp\;rtbip=192.184.70.137&amp\;rtbdata2=eaaaiencvf9odwdnzxrzx1e0mjfftwfuywdlzf9tzxj2awnlimofncj-jtiws_b-ohnodhrwczovl3d3dy5syxcuy29twihbt0llsefpmvdcvwi0vmdxvi1julfbztjdullinvfzuuitwjdutjfpdu3bfukaayfd3aqeoaebqahv4fyeugeawahq-aniadv5u4til9obfllxavhtz0fpaghnqs1sufktuvntqkhlaarzydroawsyaviznracclocbmc4ronaagliagdqas7hhvv4n_fmqqhgagdoagd4agckaxywlnb1yi0xmjyxotkyndq0odazodc1mamaqamasgmejmh7angd_dgd4gmpcc13x0fzdu13m1baujj36gmfcngfefryawu5mjeymfgdaiaeayoedxf1yw50y2fzdc1xyzhybajvuw&amp\;redirecturl3=https://www.cbtnuggets.com/?utm_source=quantcast&amp\;utm_medium=prospecting&amp\;utm_campaign=general_us&amp\;utm_term=testimonial&amp\;qc_campaign=cbt_nuggets_q421_managed_service&amp\;qc_adid=2078771"; http_uri; nocase; content:"exch.quantserve.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wfg/odrivex/"; http_uri; nocase; content:"exploringvt.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/page/wtnmmwbohho9b/"; http_uri; nocase; content:"express.adobe.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/file/hd7jn-/h1sgn.html"; http_uri; nocase; content:"f004.backblazeb2.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/updates/wb/index.php"; http_uri; nocase; content:"facetkt.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/investorway"; http_uri; nocase; content:"feeds.feedburner.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/vgfyz2v0tg9bpuytype33554433vgfyz2v0tg9bpuytype33554433/"; http_uri; nocase; content:"ferrumtransport.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v0/b/aspire-127b7.appspot.com/o/dnd.html?alt=media&amp\;token=58da9567-441f-4f7b-bf07-290e808e5d8d"; http_uri; nocase; content:"firebasestorage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v0/b/aspire-127b7.appspot.com/o/dnd.html?alt=media&amp\;token=58da9567-441f-4f7b-bf07-290e808e5d8d#hughesmichaela06@gmail.com"; http_uri; nocase; content:"firebasestorage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v0/b/cardilogist91983.appspot.com/o/index.html?alt=media&amp\;token=40dc7341-52e7-495f-8ba3-04f739b67ca0#@yorku.ca"; http_uri; nocase; content:"firebasestorage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v0/b/dr-clin-c4f68.appspot.com/o/drweb.html?alt=media&amp\;token=09293ba9-0738-41ea-9cf3-67cb43af2b88&amp\;x=famacas-cfa0appspotappspotmacas-macas-vfwefsaxsppspotcfa0ps&amp\;prox=p2000isolation@aaa.kr"; http_uri; nocase; content:"firebasestorage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v0/b/dr-clin-c4f68.appspot.com/o/drweb.html?alt=media&amp\;token=09293ba9-0738-41ea-9cf3-67cb43af2b88&amp\;x=famacas-cfa0appspotappspotmacas-macas-vfwefsaxsppspotcfa0ps&amp\;prox=yourname@yourcompany.com"; http_uri; nocase; content:"firebasestorage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v0/b/jonfrnogomint.appspot.com/o/jonguyvupvipshi.html?alt=media&token=2528c54b-142c-4e25-b0a9-03affa618055"; http_uri; nocase; content:"firebasestorage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v0/b/nnnnzzmbcmmm.appspot.com/o/index.html?alt=media&amp\;token=ff8efd0e-8cdb-4767-998b-f421eee08f97"; http_uri; nocase; content:"firebasestorage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v0/b/okorocha-9d683.appspot.com/o/indexxevol.html?alt=media&amp\;token=f9ee1486-b8df-4f55-8b9c-466fcdcf99a9#@yorku.ca"; http_uri; nocase; content:"firebasestorage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v0/b/outlook-4c0f2.appspot.com/o/books%2fwebmail.htm?alt=media&amp\;token=216401d2-aba7-42f4-8fd5-9b672cade830#abuse@optusnet.com.au"; http_uri; nocase; content:"firebasestorage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v0/b/outlook-4c0f2.appspot.com/o/books%2fwebmail.htm?alt=media&amp\;token=216401d2-aba7-42f4-8fd5-9b672cade830#tiekimas@tidlo.lt"; http_uri; nocase; content:"firebasestorage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v0/b/pass-up-date-now.appspot.com/o/update-update-update%2findex.html?alt=media&amp\;token=d3144df5-bf15-4058-a0dc-9610b1a9193c#email=info@domain.tld"; http_uri; nocase; content:"firebasestorage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v0/b/preserving019029.appspot.com/o/index.html?alt=media&amp\;token=caa885e7-5275-4bde-bc3d-a3eb2c95dfee#r@yorku.ca"; http_uri; nocase; content:"firebasestorage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v0/b/rei-rezuio-rexire-565.appspot.com/o/%40%40%40indexv-vb-vau-ry-8%252fbv-yu-er-8f%25252525%2525252f%25252525%2525252f%25252525%2525252f%25252525%2525252f%25252525%20-%20copy.html?alt=media&amp\;token=da92acdd-870d-4049-b9ac-f0d373777f06#info@legalshield.com"; http_uri; nocase; content:"firebasestorage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v0/b/rned-a824v.appspot.com/o/gen%252findex2oli.html?alt=media&amp\;token=828c2259-c86f-442e-91a0-8d43a1fe7d8b#abuse@optusnet.com.au"; http_uri; nocase; content:"firebasestorage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v0/b/scnzmaccsscnncttw.appspot.com/o/index.html?alt=media&amp\;token=fe08a148-55d4-4bb8-8d3a-53479440818f"; http_uri; nocase; content:"firebasestorage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v0/b/tei-neriou-reuix-678.appspot.com/o/%40%40%40indexv-vb-veu-ry-8%25433%2569.html?alt=media&amp\;token=6b0a9c43-8711-491b-9f40-50ad280ffb32#ggradnigo@prepaidlegal.com"; http_uri; nocase; content:"firebasestorage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v0/b/update-d2e45.appspot.com/o/update%2fupdate%2findex.html?alt=media&amp\;token=ca2d4bde-8124-4812-9c7a-1ff88eb47549#@yorku.ca"; http_uri; nocase; content:"firebasestorage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ayo1"; http_uri; nocase; content:"flow.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200014446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/btinternetwebmail"; http_uri; nocase; content:"flow.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200014447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/btphp"; http_uri; nocase; content:"flow.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200014448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dike"; http_uri; nocase; content:"flow.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200014449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hb247"; http_uri; nocase; content:"flow.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200014450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hkn01"; http_uri; nocase; content:"flow.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200014451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/inv6"; http_uri; nocase; content:"flow.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200014452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/khjrir"; http_uri; nocase; content:"flow.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200014453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pre42"; http_uri; nocase; content:"flow.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200014454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/vdg01"; http_uri; nocase; content:"flow.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200014455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/p/13c1ofsbi?fc=0"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/p/13wrz1ibd?fc=0"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/p/1s6hcovwa?fc=0"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/p/1s6jiqmub?fc=0"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/p/1sbjwytzo?fc=0"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/p/1scqelfiy?fc=0"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/p/1shwmjpay?fc=0"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/p/jsoo0zbqr?fc=0"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/page/aol-managementservices"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/page/ayo1"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/page/billbts"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/page/brooad"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/page/bsp12"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/page/btiinternet"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/page/btiinternet0"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/page/btinternetwebmail"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/page/btphp"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/page/dido1"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/page/dike"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/page/dixatt"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/page/ejo29"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/page/hb247"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/page/hip"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/page/hkn01"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/page/inv6"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/page/j50"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/page/jkh09"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/page/khjrir"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/page/pre42"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/page/vdg01"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/page/xpsatt"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/page/ysl7"; http_uri; nocase; content:"flowcode.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/campaign/"; http_uri; nocase; content:"fnthaidairies.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/img/redeem/web/"; http_uri; nocase; content:"fnthaidairies.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/taken/xyz/index.html"; http_uri; nocase; content:"football-result.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/220989044830359"; http_uri; nocase; content:"form.jotform.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/221027503251138"; http_uri; nocase; content:"form.jotform.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/221186654354155"; http_uri; nocase; content:"form.jotform.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/221295519236559"; http_uri; nocase; content:"form.jotform.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1mqqu8exzgpptqpl8"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200014495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8epxhwdapiab7mfw7"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200014496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8vb7wfyzcoeb6vvj8"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200014497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9bwawhpz5vi7ilpe6"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200014498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/akohiguxjs9wlpu28?sllqm"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200014499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b7lqaal42juffiw1a"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200014500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bfz2l7i3wvrp5heb9"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200014501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cfqg5uz57ehywkhp7"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200014502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cqzwfmqvrsnm7wrq9"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200014503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ejefrdpmyoad4gm58"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200014504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eozlrnnf7jh84xdp8"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200014505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fzlons3fgnjdqdd19?omgbfzrazhlppbtx"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200014506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/goerpntl5tfeumdz6"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200014507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/iai7pzm4pxyb145i9"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200014508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jnkkauxwwbfhtuqz9?hkgotygikyoujp"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200014509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jzxtb9auexgjcewfa"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200014510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/kehch96avaku7oey7?akowgmooutpwa"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200014511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mwctig62j4y5mgm3a"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200014512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/nokye42b5qkubgnt9"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200014513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/puadbxscibgw5ma79?xfccuwmmhgwrwztd"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200014514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/qxxe9xuu3h1lgpyc9"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200014515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/rwpcmhm8vtfa7f4m8"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200014516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/sj21ehdebhkcpvfv6"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200014517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/smufgmyhduckbq6ka?fjxhgyroek"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200014518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uqzzznxv4cfhu3yr9"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200014519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/v5xtnywt5s6zvpp27"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200014520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/w6uh9p66tdq6l1m66"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200014521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/x3aasffazsrl8pcr9"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200014522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/xxjqmu6luzkpnalg6"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200014523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/yfxkceytox2zuyvb6"; http_uri; nocase; content:"forms.gle"; content:"Host"; http_header; classtype:attempted-recon; sid:200014524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/5ed641e5cabd481304386f35b9120276/"; http_uri; nocase; content:"forms.monday.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/5ed641e5cabd481304386f35b9120276?r=use1"; http_uri; nocase; content:"forms.monday.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/deef05667ad4b4a16abdf4cb6da54137"; http_uri; nocase; content:"forms.monday.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pages/responsepage.aspx?id=95vlqxxdseiozn16dgibdsdprn5ritrknkwe8o-kcqduntbduvdwsutpqzzcmk85mfdrsjk1u0pats4u"; http_uri; nocase; content:"forms.office.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaao__tdasqlurfrqmjzxneyxn0g3vexutfvzq0mztu9fms4u"; http_uri; nocase; content:"forms.office.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaao__thg5xvuodnbwtvytzhwwdnctknvovo4tldctexmvi4u"; http_uri; nocase; content:"forms.office.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pages/responsepage.aspx?id=jrbxvx3x9keewcq72hm6fnkqekonandcsjd9av060h5urepumvvgmks2te41rfewmlletulvufnuqy4u"; http_uri; nocase; content:"forms.office.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/r/ne89gvwrye"; http_uri; nocase; content:"forms.office.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/247michaelbryan/form/signinyourbtaccountcorrectly1"; http_uri; nocase; content:"forms.zoho.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pattles066/form/signinyourbtaccountcorrectly"; http_uri; nocase; content:"forms.zoho.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/traskray168/form/signinyourbtaccountcorrectly1"; http_uri; nocase; content:"forms.zoho.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/armandb622/form/signinyourbtaccountcorrectly"; http_uri; nocase; content:"forms.zoho.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mucmddc993/form/signinyourbtaccountcorrectly"; http_uri; nocase; content:"forms.zoho.eu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"fredsamasont.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/php/newdocs/"; http_uri; nocase; content:"generator.discordnitrogift.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"getrfdeza.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1189s6"; http_uri; nocase; content:"gg.gg"; content:"Host"; http_header; classtype:attempted-recon; sid:200014541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ydcr0"; http_uri; nocase; content:"gg.gg"; content:"Host"; http_header; classtype:attempted-recon; sid:200014542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2022/01/daily-rm8888-shopee-1_23.html?m=1"; http_uri; nocase; content:"gift-1212.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/o/free/?elqcampaignid=9288/"; http_uri; nocase; content:"go.docusign.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?xcust=2c8967cc0ec911ec9332aea895ef3e670int&amp\;test=off&amp\;id=355x561&amp\;url=https://www.paypal.com/shopping/&amp\;xguid=01fez46yyrvh6f0bbehn8h419h&amp\;persistence=1&amp\;checksum=069f46345ac935567ad562a3d64a332066064c97f8feae803d555f9cc820c561"; http_uri; nocase; content:"go.skimresources.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?xcust=2c8967cc0ec911ec9332aea895ef3e670int&amp\;test=off&amp\;id=355x561&amp\;url=https://www.paypal.com/shopping/&amp\;xguid=01fezncfbjbj86yneatjn0qvt4&amp\;persistence=1&amp\;checksum=8142350e161acc6cb246be1d05d596973a1d3ac50af1f3594ee9ea462c87a4ef"; http_uri; nocase; content:"go.skimresources.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?xcust=2c8967cc0ec911ec9332aea895ef3e670int&amp\;test=off&amp\;id=355x561&amp\;url=https://www.paypal.com/shopping/&amp\;xguid=01ff06m6n2q43m6zcaqrh8xpm2&amp\;persistence=1&amp\;checksum=26e140f8abae23dd0c8dd547390a4deb9fc54b1acf3539d8aa44fb19e04902ef"; http_uri; nocase; content:"go.skimresources.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?xcust=2c8967cc0ec911ec9332aea895ef3e670int&amp\;test=off&amp\;id=355x561&amp\;url=https://www.paypal.com/shopping/&amp\;xguid=01ff0qxy635yfpkrdaxav47j5k&amp\;persistence=1&amp\;checksum=cb2e0f7328d6ffea0e15a24046095a0bb98d27d4488e822bea4b181763f2eb0b"; http_uri; nocase; content:"go.skimresources.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/aksf"; http_uri; nocase; content:"goo.su"; content:"Host"; http_header; classtype:attempted-recon; sid:200014549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/url?q=https://spk-kunden-manager.com/rcjju7exxu#1lwkr92k20x&sa=d&sntz=1&usg=aovvaw1sjseir4b0q4l8sbg3z3us"; http_uri; nocase; content:"google.ch"; content:"Host"; http_header; classtype:attempted-recon; sid:200014550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/url?hl=en&amp\;q=https://quarantine29042022app-1311615844.cos.ap-chengdu.myqcloud.com/aaqkagm3ztm2odcyltawzgmtndk3ns05zjuxltixzmyyyznkntexmgaqadpitonhie1hjl70qeb7vdi-quarantine02719message283/quarantine.html%23pimo@apms-ltd.com&amp\;source=gmail&amp\;ust=1654842023923000&amp\;usg=aovvaw3tlbzf2sxh2-mtjs7iurao"; http_uri; nocase; content:"google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/url?mo=78986685794&q=https://c1r.at/h49xmdcp&zp=5095739289&kf=59242331&sa=d&usg=afqjcnf_3jyqkupfmf1gle_0jmhtak3s0w"; http_uri; nocase; content:"google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/url?q=http%3a%2f%2fbit.do%2ffr6ci&sa=d&sntz=1&usg=afqjcne7joz-iz-adrzkrxcihj8t9fs9qw"; http_uri; nocase; content:"google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/url?q=http%3a%2f%2fbit.do%2ffsgjq&amp\;sa=d&amp\;sntz=1&amp\;usg=afqjcngvqc30z-4hiaizv03gpwblwu3vnw"; http_uri; nocase; content:"google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/url?q=http%3a%2f%2fcanarytokens.com%2farticles%2fterms%2fimages%2f6273376tgy8lrrnek9ai08a01%2fredirect.html&amp\;sa=d&amp\;sntz=1&amp\;usg=aovvaw20yd4y6h3k2ostqzlu8pmd"; http_uri; nocase; content:"google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/url?q=http://nouvelles-hybrides.fr/wp-admin/general/hhhheng/hhhheng/hhhhh.php?email%3d%5b%5b-email-%5d%5d&amp\;source=gmail&amp\;ust=1648980902684000&amp\;usg=aovvaw3lj6xdrkr7te65my0ifv8q"; http_uri; nocase; content:"google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/url?q=https%3a%2f%2f51.fi%2fai6n&amp\;sa=d&amp\;sntz=1&amp\;usg=aovvaw3ztrphk75w64vrj-rkdbza"; http_uri; nocase; content:"google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/url?q=https%3a%2f%2fpo9cz.weebly.com&amp\;sa=d&amp\;sntz=1&amp\;usg=afqjcnec0vbdyqyotdsbz7gijk588avcwg"; http_uri; nocase; content:"google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/url?q=https%3a%2f%2ftestwordpress.top%2fwp-content%2facaynumpang.html&sa=d&sntz=1&usg=afqjcneq22nczpte3zh2zdvetbj9kx5z1g"; http_uri; nocase; content:"google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/url?q=https%3a%2f%2fvip.91234567.cn%2fwp-includes%2firsapi1.html&sa=d&sntz=1&usg=afqjcnfo-ujbo-tnv5d6why8olvgunjxjq"; http_uri; nocase; content:"google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/url?q=https%3a%2f%2fvk.cc%2fcbjxkb&sa=d&509=848&usg=afqjcnec4gkgoe88ifnjjrnagnlez6uneq"; http_uri; nocase; content:"google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/url?q=https://393512dfd8544c98be9a40f2f67df8bd.svc.dynamics.com/t/r/a7uua5shyiplufx4zj7f6u2clgtguiagoxngfoio4am?clientid%3d70000%23%5bemail%5d%2b00-70000&amp\;source=gmail&amp\;ust=1636719774661000&amp\;usg=aovvaw2fsk8htfwhsfqapvbu674n"; http_uri; nocase; content:"google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/url?q=https://c1r.at/fzleuule&ry=9080899&sa=d&ha=9992286639&usg=afqjcngde0oxaxjtp-semb24qndyxqpfeg&jj=95316071"; http_uri; nocase; content:"google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/url?q=https://c1r.at/n62bfdcp&od=3896761062&sa=d&usg=afqjcnhmj6a5ejlmnfnws314axi9thcopa&qw=69345649672&rh=90290680"; http_uri; nocase; content:"google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/url?q=https://turkeycovebc.org/geno/autozim/index.php?email%3dzinat.naher@datasoft-bd.com&amp\;source=gmail&amp\;ust=1654067759166000&amp\;usg=aovvaw2hwrhptpk-tshyvcxc-uo2"; http_uri; nocase; content:"google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/aclk?sa=l&ai=dchcsewif_of35ej4ahwpgqyahbnfadsyabaaggj3cw&sig=aod64_1zys9ozm5uti9mbegr6nynfsyvlq&q&adurl&ved=2ahukewj9tv325ej4ahvcx_edhv7ocdyq0qx6bagdeae"; http_uri; nocase; content:"google.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200014566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/url?q=https://spk-kunden-manager.com/rcjju7exxu#sx0z5vskhyx&sa=d&sntz=1&usg=aovvaw3wt2smooknv0nq-tlwykit"; http_uri; nocase; content:"google.vg"; content:"Host"; http_header; classtype:attempted-recon; sid:200014567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/i?u=a894ec7f.46t33454t4.pages.dev?user=masoli@legalshieldassociate.com"; http_uri; nocase; content:"googleweblight.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/i?u=b4e921f0.sso-mailsrvr-4344e5teed.pages.dev?user=abuse@gmail.com"; http_uri; nocase; content:"googleweblight.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/i?u=https://webmailn0s9344.myssomailsecure-srvr3.ws24.biz/index.html?submit=redacted@redacted.tld"; http_uri; nocase; content:"googleweblight.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/:x:/r/personal/tspencer_gormanusa_com/_layouts/15/wopiframe.aspx?guestaccesstoken=wgfwcmmssvdsofa7ljviwaj85tleclug2xbvoqwlmp0%3d&amp\;docid=1_12424441d8c29412bb868684e5cb74e47&amp\;wdformid=%7b992e319a%2dbe72%2d460b%2db6b4%2d2d3fcf789fc5%7d&amp\;action=formsubmit"; http_uri; nocase; content:"gormanusa-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/flagup3489/index.html"; http_uri; nocase; content:"gxd.xvt.mybluehost.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200014572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cackx"; http_uri; nocase; content:"han.gl"; content:"Host"; http_header; classtype:attempted-recon; sid:200014573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fmjiu"; http_uri; nocase; content:"han.gl"; content:"Host"; http_header; classtype:attempted-recon; sid:200014574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/lgsjo"; http_uri; nocase; content:"han.gl"; content:"Host"; http_header; classtype:attempted-recon; sid:200014575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/vvzrf"; http_uri; nocase; content:"han.gl"; content:"Host"; http_header; classtype:attempted-recon; sid:200014576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wrqjp"; http_uri; nocase; content:"han.gl"; content:"Host"; http_header; classtype:attempted-recon; sid:200014577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2021/12/window.html"; http_uri; nocase; content:"hangovertest1.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/00000111"; http_uri; nocase; content:"heylink.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200014579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/secure/id/index.php"; http_uri; nocase; content:"higherselfdevelopment.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?https://dplux.com.ng/cgi-bin/"; http_uri; nocase; content:"href.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200014581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?https://free-url-shortener.rb.gy/"; http_uri; nocase; content:"href.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200014582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?https://ib.adnxs.com/seg?redir=https://secure.adnxs.com/seg?redir=http://owl.li/pphv30sb9tt"; http_uri; nocase; content:"href.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200014583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?https://trimurl.co/0wsx7z"; http_uri; nocase; content:"href.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200014584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?https://www.aquarelle.es/tienda/ramos-de-rosas/"; http_uri; nocase; content:"href.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200014585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?https://www.google.com/search?q=m&t+login"; http_uri; nocase; content:"href.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200014586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?https://ykm.de/f4b990c239777330"; http_uri; nocase; content:"href.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200014587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/https://aratera.com/wp-admin/"; http_uri; nocase; content:"href.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200014588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/https://performancelocal.com/wp-admin/"; http_uri; nocase; content:"href.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200014589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"//ykm.de/f4b990c239777330"; http_uri; nocase; content:"href.li?https:"; content:"Host"; http_header; classtype:attempted-recon; sid:200014590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ebuse/servic"; http_uri; nocase; content:"i-m.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200014591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/webaccountupdate/stockholmsuniversitet/"; http_uri; nocase; content:"i-m.mx"; content:"Host"; http_header; classtype:attempted-recon; sid:200014592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/prostars/index.html"; http_uri; nocase; content:"idola.net.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200014593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9834665191/css/tt/security/cont.php"; http_uri; nocase; content:"ief.tqa.mybluehost.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200014594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mdkea5ckpozm/click-here-to-start"; http_uri; nocase; content:"ifyufyujk.quip.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/4t6u/bt"; http_uri; nocase; content:"im-creator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/4t6u/e"; http_uri; nocase; content:"im-creator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/btbroadband/bt_broadband"; http_uri; nocase; content:"im-creator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/btin/bt"; http_uri; nocase; content:"im-creator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/fgjjm/1-xp"; http_uri; nocase; content:"im-creator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/iuhj/kay"; http_uri; nocase; content:"im-creator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/kennymoore12/btinternet"; http_uri; nocase; content:"im-creator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/kfouo/btcommmms"; http_uri; nocase; content:"im-creator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/lasodi2/attworld"; http_uri; nocase; content:"im-creator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/lofty2/mobileatt"; http_uri; nocase; content:"im-creator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/microvalid/bt_mail"; http_uri; nocase; content:"im-creator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/microvalid/btcomms"; http_uri; nocase; content:"im-creator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/microvalid/btcommuni"; http_uri; nocase; content:"im-creator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/msw0rd/att_word"; http_uri; nocase; content:"im-creator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/msw0rd/attsusers"; http_uri; nocase; content:"im-creator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/viewer/vbid-31138d48-omsttuer"; http_uri; nocase; content:"im-creator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/viewer/vbid-fa0f29d5-fpsjmms8"; http_uri; nocase; content:"im-creator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/viewer/vbid-fa0f29d5-fpsjmms8"; http_uri; nocase; content:"imcreator.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/emailupdatee/owaweb"; http_uri; nocase; content:"imxprs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/outlookwebaccessupgrade/outlookwebaccessupgrade"; http_uri; nocase; content:"imxprs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/free/webmaiil/accounttportal"; http_uri; nocase; content:"imxprs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/secure.center/auth.php"; http_uri; nocase; content:"infinitypotential.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200014617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/na/en-us.html"; http_uri; nocase; content:"ingredion.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-includes/js/net/"; http_uri; nocase; content:"injazrest.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/authorize/1658137088767158"; http_uri; nocase; content:"inpost-pl-hid226ks.id-umowa83981.wiki"; content:"Host"; http_header; classtype:attempted-recon; sid:200014620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/authorize/1658137088767158"; http_uri; nocase; content:"inpost-pl-my-id2g3ys.id-umowa458230.click"; content:"Host"; http_header; classtype:attempted-recon; sid:200014621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tracking/93470003"; http_uri; nocase; content:"inpost-pl-my-id2g3ys.id-umowa83981.wiki"; content:"Host"; http_header; classtype:attempted-recon; sid:200014622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-admin/maint/?hash=a2fyaw5hywxtzwlkyxjpymvpcm9aag90bwfpbc5jb20="; http_uri; nocase; content:"insurance2019.moneynet.com.tw"; content:"Host"; http_header; classtype:attempted-recon; sid:200014623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9g9h"; http_uri; nocase; content:"inx.lv"; content:"Host"; http_header; classtype:attempted-recon; sid:200014624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9git"; http_uri; nocase; content:"inx.lv"; content:"Host"; http_header; classtype:attempted-recon; sid:200014625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9gkk"; http_uri; nocase; content:"inx.lv"; content:"Host"; http_header; classtype:attempted-recon; sid:200014626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hvsy"; http_uri; nocase; content:"inx.lv"; content:"Host"; http_header; classtype:attempted-recon; sid:200014627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/bafkreidurg3sni5oyyppei4dkijavell3dvpgmgmnlbdcflmkbffxj7smq"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200014628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/bafybeiafsdfemujye4pouqywu7n6w5djcepo7nsspngfirhuzsbvgb3mxi"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200014629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/bafybeieva3f7armucd63rfnbkjdggoj2jinojmwpsavqr3xwcc4uhucryq?utm_source=benchmarkemail&utm_campaign=godson&utm_medium=email"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200014630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmbtirqa8ezbj2rhbjd7bg8ncingx4hjcurnmul6dapx5a/#"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200014631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmu95i1krcpmmbfpaurvbwmh8r7jertq1dfkzmymjqdwbp/index0000.html"; http_uri; nocase; content:"ipfs.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200014632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmavzjxyvjphephf6mbujqy8jyyd4qaejbjivmfevwh2ku"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200014633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmb932xecfi4wfvkks4rtqpsdxwaz9dhb3gpp37cjttnln"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200014634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmbgawdnomoxa7uguu92eahh216xfaxqay8pbhxa2ospis"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200014635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmbnb9dhkzfrwmpsznxhuxrdmpe6k8yrzqnd7yppyaznrm?filename=chibrr0thsharepoint-verification-authentication-mentional-servericesp-00000000000000000000000000000000000000000000000000123455%20-%20copy%20-%20copy.htm"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200014636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmebhkt36w3jfrll2k4jevvpvsniym5nessgtvjuaqjxje?key=bf38df4466e9cb6870142585341d7c28c4be5cba&url_01=https://asserta-honeyedly-toom.s3.us-west-004.backblazeb2.com/index.html&url_02=https://climacium-opuntiales-retar.s3.eu-central-003.backblazeb2.com/index.html&url_03=https://equalled-hylodes-penmanship.s3.eu-central-003.backblazeb2.com/index.html&url_04=https://keepsaky-samiri-subcyanide.s3.eu-central-003.backblazeb2.com/index.html&url_05=https://eccyesis-euge-splatterfaced.s3.eu-central-003.backblazeb2.com/index.html&redirect=https://www.amazon.com"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200014637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmeovtwrjpg7rszvixqcmfxjpdvwagxtggo14b5eq5hhpf"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200014638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmqsqqjdkuerjzebkjm5hgghjegjpufmplsxccuvzem4jw/"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200014639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmsspufpt6xsxm3drsymuzeyu9wqzgc5qdqvmqxokkkjoy"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200014640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmtpycebrrdvcxfkdaiquxv7cx15nja79trluntcxeq7w7/page.html"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200014641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmtum1kurdm4zscbehopn9xhcrfoxkhg6zxyga9mwbxw8w?filename=0299000netease1000000000000000000000077700000000000000doc00000000000000000000000000000000000000000000000000000000000000000788888888888888888888888888877788877777777777748888888888888888.html"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200014642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmvdnnh54ulexbapsfgbwyunwxyhthgv7sfh3pbsdpqgam"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200014643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ipfs/qmzwakbww7ts1cgzshuptzh14df7jcpipomqhvanfm1p7j/index.html"; http_uri; nocase; content:"ipfs.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200014644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/37dzyx?confirmations"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200014645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/appcertificata"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200014646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e1gipy?confirmations"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200014647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hrjxyc"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200014648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/montpaschl"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200014649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n26assistenzaclienti"; http_uri; nocase; content:"is.gd"; content:"Host"; http_header; classtype:attempted-recon; sid:200014650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dost"; http_uri; nocase; content:"jefigscredit.co.ke"; content:"Host"; http_header; classtype:attempted-recon; sid:200014651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dost/"; http_uri; nocase; content:"jefigscredit.co.ke"; content:"Host"; http_header; classtype:attempted-recon; sid:200014652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/code-eu1.jivosite.com/widget/jqqceif7de"; http_uri; nocase; content:"jivo.chat"; content:"Host"; http_header; classtype:attempted-recon; sid:200014653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/index.html#/home_pc"; http_uri; nocase; content:"jreast.co.jp.hyrbg0.cn"; content:"Host"; http_header; classtype:attempted-recon; sid:200014654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/index.html#/home_sp"; http_uri; nocase; content:"jreast.co.jp.jiem.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/index.html#/home_sp"; http_uri; nocase; content:"jreast.co.jp.xiaoxu.buzz"; content:"Host"; http_header; classtype:attempted-recon; sid:200014656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7euow"; http_uri; nocase; content:"jtbtigers.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/personal/jdonahue_k12_com/_layouts/15/wopiframe.aspx?guestaccesstoken=jxndynkzmynao0nofzmhz4t%2fk%2br%2fg7qir2agrjo42ha%3d&docid=1_12252b23331654ef4bf8ef978a8eb83ee&wdformid=%7b2711d93c%2d7591%2d4baa%2db377%2dcf40ba8c7343%7d&action=formsubmit"; http_uri; nocase; content:"k12inc-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"kakasoufatre.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/contact-us/2970503358622564"; http_uri; nocase; content:"keap.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/camelon/index.html#abuse@optusnet.com.au"; http_uri; nocase; content:"kelleyinthekitchen.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bt_internet"; http_uri; nocase; content:"koji.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200014662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bt_service_alert."; http_uri; nocase; content:"koji.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200014663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bt_teem"; http_uri; nocase; content:"koji.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200014664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/.tmb/cose//correos/?clp=327598322"; http_uri; nocase; content:"krizia.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200014665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/.tmb/cose//correos/seleccione_medio_de_pago.php"; http_uri; nocase; content:"krizia.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200014666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fthaqu"; http_uri; nocase; content:"kutt.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200014667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/l3leph"; http_uri; nocase; content:"kutt.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200014668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/swissssss"; http_uri; nocase; content:"kutt.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200014669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dhtanx/office/index.php"; http_uri; nocase; content:"kuyhaa-me.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200014670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dhtanx/office/index2.php"; http_uri; nocase; content:"kuyhaa-me.pw"; content:"Host"; http_header; classtype:attempted-recon; sid:200014671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/amazon-account-locked-id9517453"; http_uri; nocase; content:"l.ead.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200014672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bdbxhz"; http_uri; nocase; content:"l.ead.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200014673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/l?u=https://abre.ai/eduz?userid=nwwuer4j"; http_uri; nocase; content:"l.wl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200014674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/l?u=https://abre.ai/een1?userid=gkywgnp7"; http_uri; nocase; content:"l.wl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200014675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/l?u=https://abre.ai/egic?userid=urrtk9bo"; http_uri; nocase; content:"l.wl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200014676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/l?u=https://abre.ai/ei3z?userid=nl7mbjhz"; http_uri; nocase; content:"l.wl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200014677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/l?u=https://bit.ly/3mlmufl?trackingid=asgfti6f&signature=newsletter"; http_uri; nocase; content:"l.wl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200014678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/l?u=https://s.id/12ezw?userid=g8tmk6cv"; http_uri; nocase; content:"l.wl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200014679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/l?u=https://s.id/12ezw?userid=iwhzddbk"; http_uri; nocase; content:"l.wl.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200014680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a0n"; http_uri; nocase; content:"l24.im"; content:"Host"; http_header; classtype:attempted-recon; sid:200014681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/lokadot/index.php"; http_uri; nocase; content:"lakouproject.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/627d1ee47d4cb80020d558aa"; http_uri; nocase; content:"ldp.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200014683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/62985118879fa500156595cf"; http_uri; nocase; content:"ldp.page"; content:"Host"; http_header; classtype:attempted-recon; sid:200014684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1rvqqm"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200014685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8nyk33"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200014686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9onwxq"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200014687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/assessoriabvonline"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200014688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/atdminhabv"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200014689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bvha"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200014690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cupommagalo_2022"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200014691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fguugio"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200014692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hdyhid"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200014693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hifyiu"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200014694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jgbjg"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200014695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jrpvy"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200014696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mssdxd"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200014697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/nuinvest"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200014698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/nupagamentos21"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200014699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pagamentos.a"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200014700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/portalclientebv"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200014701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/qk1m4v"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200014702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/rubbishrubiish"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200014703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/suportedigital2"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200014704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/vv06p6"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200014705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/vvolr6"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200014706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/w1p0l6"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200014707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/woo3x4"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200014708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/yahuumail"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200014709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/yhooooo"; http_uri; nocase; content:"linkr.bio"; content:"Host"; http_header; classtype:attempted-recon; sid:200014710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cupom-americana-site"; http_uri; nocase; content:"linkr.bio:443"; content:"Host"; http_header; classtype:attempted-recon; sid:200014711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/accountupdate12"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/activitlogs"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/adamson12345"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/admin__"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/adminboxalert"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/adminboxalerta"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/alcorbeil503"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/alertadminboxs"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/alertmoreadmin"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/aoladmin_"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/appiesecure2021"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/att.net12"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/attaccntsachieve"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/attmailuser"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/attservice67"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/britishtelecommunciation"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bt.o.world"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bt45y"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bt5644"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/btbroadteam"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/btbroadteam/"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/btcreator"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/btinternet12"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/btinternet21"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/btsecurelink/"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bttlee"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bupporrrt"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/currentl"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dfghjkjhgdfgh"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dhlpackage"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fearnomore"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ggbnhb"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ghvfg"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hendersome"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hthto204"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/imcreatorboard"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/imcreatorbt"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jfgjg"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jgbjgbjh"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/johnbrownn4811"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/johnbulljohn"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mail1083"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/makee4"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/marhfx"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/millie5566"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/newaccount12"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/redirtoken981?dop=991154801"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/sbccglob"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/secubtscjotj"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/status/blocked?username=attservice67"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/status/blocked?username=btsecurelink"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/submisin"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/supportleee"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/updategmxmail"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/verifyyourprotonmailemail"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/webmaioptus"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/xxxx5"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/yahooatt"; http_uri; nocase; content:"linktr.ee"; content:"Host"; http_header; classtype:attempted-recon; sid:200014769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mk/lin/lin/"; http_uri; nocase; content:"livablefutureblog.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/personal/hannah-daly_live_nmit_ac_nz/_layouts/15/wopiframe.aspx?guestaccesstoken=ia5uzzon3iviku4f3pxemyhhabfwkpdjirpftfear%2fk%3d&docid=1_169208e425ed84fea9fd294a6886d67e9&wdformid=%7b06255f86%2d4bf9%2d4ee8%2dbd7e%2dfef81913a79b%7d&action=formsubmit"; http_uri; nocase; content:"livenmitac-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/personal/hannah-daly_live_nmit_ac_nz/_layouts/15/wopiframe.aspx?guestaccesstoken=ia5uzzon3iviku4f3pxemyhhabfwkpdjirpftfear/k=&amp\;docid=1_169208e425ed84fea9fd294a6886d67e9&amp\;wdformid={06255f86-4bf9-4ee8-bd7e-fef81913a79b}&amp\;action=formsubmit"; http_uri; nocase; content:"livenmitac-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d-3hbjpx"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d2cagqdm"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d_kqpmtx"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dfxw4_sm=ojdszb15xdzzzv"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/di6hueus"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/di_qntwp"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/difsmpfx"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dkng9_k3"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dnnpnd4y"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dr4agxum"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/drgcsgzw"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/drsgmgjm"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/drxkr5pj"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dvmqs3eb"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e2p8spez"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e3g9qxhs"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e55ej5xx"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e5gzdpqa"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e_idwusk"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/earmae2d%22"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/easrgdqg"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ecymrzgu"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/edvvp6ax"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ee5yc9ca"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eefrfkzq?=ojiouwexpg8h5s"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/egbbkcqr"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ehk85dzy"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/emmrycxb"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/epbe4esg"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eqe_7fzg"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eqexis8b?=779auzfcptp61w"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/esh6x-2g"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/esjzqf_8"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/et-dkcdj"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eu3tad-d"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/euhr7uki"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/evbzscwd"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/evjgv5bv?=eme9jh5wippejx"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ewfyckzm"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ews7fgtw"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/exc7h6tz"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ez2wd7tg"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ezztetjp"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/g45cgcft"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/g6y3fhkt"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gat_yr4c"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gbs4ecw8"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gczqssnv"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gepk78hu"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gezjhddn"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gfudg_bw"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ghktz_zc?=asrrne8hwgbpmp9"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ghktz_zc?=jjbpe2kkugganzg"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ghktz_zc?=yh2qhzgzcwjq4ri"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gm9mx7ii"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gnpurze8"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/grxqxr5n"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gtqqwvzn"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gxsukn_z?=hmawyn6k"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gyrmxhc4"; http_uri; nocase; content:"lnkd.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/de/?code=1a468e385b9475ae1d0bfa645841a01f"; http_uri; nocase; content:"login-live.com-s02.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200014833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/rccl"; http_uri; nocase; content:"login.salaryatsea.mycrewallet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"lolosamarte.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ppt9"; http_uri; nocase; content:"lp.vp4.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200014836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jal0cm"; http_uri; nocase; content:"lt27.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200014837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/claimskinn"; http_uri; nocase; content:"lynk.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200014838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/stimulusbenefit9090"; http_uri; nocase; content:"m.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200014839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http%3a%2f%2foasysfactory.com/wp-includes/css/api.html"; http_uri; nocase; content:"m.vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://qrs.ly/9gdxb1c"; http_uri; nocase; content:"m.vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"maccsasred.mcaaserd.bipydu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"maccsasred.mcaaserd.zbfpbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"macsscsrd-asosamsnsrd.xdwuuu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2021/02/blog-post.html"; http_uri; nocase; content:"magyarpoosta.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/forms/form1.html"; http_uri; nocase; content:"mail.hfcfit.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cksas/vmw/index.html"; http_uri; nocase; content:"mail.roothairtransplant.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-includes/customize/index.html"; http_uri; nocase; content:"mail.roothairtransplant.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/maerl/login.php"; http_uri; nocase; content:"marketmedia.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/smaso/login.php"; http_uri; nocase; content:"marketmedia.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"masceaesnccsaaserd.maseccceaoooearescooosesaserd.pimslu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"masceaesnccsaaserd.maseccceaoooearescoooseserd.pimslu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"masceaesnccsaaserd.masecocsaaosearescoooseccsoerd.pimslu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"masceaesnccsaaserd.masecocsaaosearescoooseerd.pimslu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"masceaesnccsaaserd.masecocsaeorearescoooseccsod.pimslu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"masceaesnccsaaserd.masecocsaeorearescooosed.pimslu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"masceanccaserd.macceooascoseserd.leinfu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"masceanccaserd.macosasascoseccsoerd.aqnrdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"masceanccaserd.macosasascoseerd.afgefu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"masceanccaserd.macoserascosed.qnsaxu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"masceanrd.macceoosaserd.dsyau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"masceanrd.macceooserd.dsyau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"masceanrd.macceooserd.nmmuu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"masceanrd.macceooserd.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"masceanrd.macosaserd.dsyau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"masceanrd.macosaserd.nmmuu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"masceanrd.macosaserd.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"masceanrd.macoserd.nmmuu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"masceanrd.macoserd.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"mascecaeosncsaaserd.masecccaooarsoasoceosesaserd.xdwpdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"mascecaeosncsaaserd.masecccaooarsoasoceoseserd.xdwpdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"mascecaeosncsaaserd.masecocaorarsoasoceoseccsod.xdwpdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"mascecaeosncsaaserd.masecocaorarsoasoceosed.xdwpdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseccsoerd.xdwpdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"mascecaeosncsaaserd.masecocaosarsoasoceoseerd.xdwpdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"mascecaesncsaaserd.masecccaooarsoasocosesaserd.xdwpdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"mascecaesncsaaserd.masecccaooarsoasocoseserd.xdwpdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"mascecaesncsaaserd.masecocaorarsoasocoseccsod.xdwpdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"mascecaesncsaaserd.masecocaorarsoasocosed.xdwpdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"mascecaesncsaaserd.masecocaosarsoasocoseccsoerd.xdwpdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"mascecaesncsaaserd.masecocaosarsoasocoseerd.xdwpdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"mascesceard.mcasord.bipydu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"mascseoaoserd.maacsreoed.bipydu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"mascseoaoserd.maacsreoed.ipcvku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"mascseoaoserd.maacsreoed.zbfpbu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"mascseoaoserd.maacsreoed.zumchu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/lnk.asp"; http_uri; nocase; content:"mb102.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/certificate-checker?login=false&amp\;originalurl=https%3a%2f%2fbit.ly.mcas.ms%2f3tbqbin%3fmcastsid%3d20893&amp\;mcascsrf=0f95c59a30af1e3a152874bd1ed8389e360301a106dd1613f05a98f6033f0361"; http_uri; nocase; content:"mcas-proxyweb.mcas.ms"; content:"Host"; http_header; classtype:attempted-recon; sid:200014888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/baba/mail.ionos.com/common/auth/email-authentication-id8478388377488299287474729299942949947927449589398/user-session/auth0f38575889948399385943/?email=redacted@abuse.ionos.com"; http_uri; nocase; content:"megatherm-dev.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200014889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/sites/kellerwilliamshouston/linkout.cfm?office=http://www.hm.com&to=https://dev-fvazquejr4.pantheonsite.io/index.html#example@example.com"; http_uri; nocase; content:"members.har.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/p/cp/0ccc3066dc2bcd17/c?mi_u=87923176&mi_origin=&url=http://email.stickercanada.com/t?entity_type=2&entity_id=32534&email_pref_id=34785928&sent_id=1600423397&service_id=22668&redirect_url=https:/relievehotmailonly.cloudns.cl/imagineme/ionos.php"; http_uri; nocase; content:"mi.jetblue.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tennischampsgenesis/"; http_uri; nocase; content:"mintnft-cheapest.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/miurausa/?em=ardanbera@ardanbera.com"; http_uri; nocase; content:"miurausa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/miurausa?em=ardanbera@ardanbera.com"; http_uri; nocase; content:"miurausa.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c?tagid=6565567-e43649793250da163478de2807c5c809&amp\;idc=77972&amp\;redir=https://loginingmocrosofttbox.pllatos.com/?e=@emba.schulich.yorku.ca&amp\;"; http_uri; nocase; content:"mmtro.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/anti-v/intsall/fdy54yh44ethnutot+++++++++67====fghr5/gtg53t3=-=g0bjgib093h=053+uhv++.html"; http_uri; nocase; content:"msuac.edu.mn"; content:"Host"; http_header; classtype:attempted-recon; sid:200014896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/609890b8001f18095ac075fc"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/60deff002ca34f5aa4985ab3"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/6112452ca3f6e60d511bad0d"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/61fbd0ed6ab665110baf7c8d"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/6216d491976b950bb612ee29"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/6217e24f976b950bb6148afa"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/622ef84817a64c6cae942da3"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/622f257117a64c6cae9476f7"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/62528753e911ef58a52499d4"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/628e2c9dbd94a175bb6fe784"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/6291f287bd94a175bb75e94d"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/629b6312bd94a175bb849970"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/62a096d7bd94a175bb8dc8ec"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/62a44bd3bd94a175bb93ccfe"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/62aab8d4bd94a175bb9d8b2d"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/62ab0092bd94a175bb9df796"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/62ab0b05bd94a175bb9e08f3"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/62b21abebd94a175bba7ec1b"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/62b729dcbd94a175bbb0a072"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/62baae34bd94a175bbb57e50"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jenetwood/untitled-form-1"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/layananpihakfacebook/resmipemblokiranfacebook"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/rayzmania1/capitecbankdebitcheckmandate"; http_uri; nocase; content:"my.forms.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200014919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/epy7xq3y-office-365"; http_uri; nocase; content:"my.visme.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200014920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"myjacsasoesb-caosmsoeb.xdwuuu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"myjacsasoesb-caosmsoeb.yeceku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"myjaocsoeb.myjassceb.bdrfpu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"myjascceosocsaaseseb.mseyccaojarsoasoceoseaascsoeb.xdwpdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"myjascceosocsaaseseb.mseyccaojarsoasoceoseacsoeb.xdwpdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseccsocsoeb.xdwpdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseccsooeb.xdwpdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceosecsoeb.xdwpdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"myjascceosocsaaseseb.mseyjcaosarsoasoceoseoeb.xdwpdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"myjasccesocsaaseseb.mseyccaojarsoasocoseaascsoeb.xdwpdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"myjasccesocsaaseseb.mseyccaojarsoasocoseacsoeb.xdwpdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseccsocsoeb.xdwpdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseccsooeb.xdwpdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"myjasccesocsaaseseb.mseyjcaosarsoasocosecsoeb.xdwpdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"myjasccesocsaaseseb.mseyjcaosarsoasocoseoeb.xdwpdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"myjascesoccsaaseseb.mseycceaoojearescoooseaascsoeb.pimslu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"myjascesoccsaaseseb.mseycceaoojearescoooseacsoeb.pimslu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"myjascesoccsaaseseb.mseyjcaaaosearescoooseccsocsoeb.pimslu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"myjascesoccsaaseseb.mseyjcaaaosearescooosecsoeb.pimslu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"myjascesoccsaaseseb.mseyjcaacosearescoooseccsooeb.pimslu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"myjascoccaseseb.myceojascoseaascsoeb.afgefu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"myjascoccaseseb.myceojascoseaascsoeb.aqnrdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"myjascoccaseseb.myceojascoseaascsoeb.leinfu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"myjascoccaseseb.myceojascoseacsoeb.qnsaxu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"myjascoccaseseb.myjaasascoseccsocsoeb.leinfu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"myjascoccaseseb.myjaasascosecsoeb.qnsaxu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"myjascoccaseseb.myjacsascoseoeb.leinfu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"myjascoccaseseb.myjacsascoseoeb.qnsaxu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"myjascoseb.myceojaascsoeb.dsyau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"myjascoseb.myceojaascsoeb.nmmuu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"myjascoseb.myceojaascsoeb.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"myjascoseb.myceojacsoeb.dsyau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"myjascoseb.myceojacsoeb.nmmuu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"myjascoseb.myceojacsoeb.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"myjascoseb.myjaasccsocsoeb.dsyau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"myjascoseb.myjaasccsocsoeb.nmmuu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"myjascoseb.myjaasccsocsoeb.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"myjascoseb.myjacsccsooeb.dsyau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"myjascoseb.myjacsccsooeb.nmmuu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"myjascoseb.myjacsccsooeb.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"myjcoeeocsb.omyjaceb.bhzzeu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"myjcoesocb.mcyjaceb.iwcyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200014962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/en/b/5j9l4"; http_uri; nocase; content:"n9.cl"; content:"Host"; http_header; classtype:attempted-recon; sid:200014963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2hhwdm"; http_uri; nocase; content:"nah.uy"; content:"Host"; http_header; classtype:attempted-recon; sid:200014964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/6kxp6p"; http_uri; nocase; content:"nah.uy"; content:"Host"; http_header; classtype:attempted-recon; sid:200014965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hxnuzx"; http_uri; nocase; content:"nah.uy"; content:"Host"; http_header; classtype:attempted-recon; sid:200014966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/k4jcff"; http_uri; nocase; content:"nah.uy"; content:"Host"; http_header; classtype:attempted-recon; sid:200014967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/l4khtv"; http_uri; nocase; content:"nah.uy"; content:"Host"; http_header; classtype:attempted-recon; sid:200014968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pogdut"; http_uri; nocase; content:"nah.uy"; content:"Host"; http_header; classtype:attempted-recon; sid:200014969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/q3euu4"; http_uri; nocase; content:"nah.uy"; content:"Host"; http_header; classtype:attempted-recon; sid:200014970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/qzadbp"; http_uri; nocase; content:"nah.uy"; content:"Host"; http_header; classtype:attempted-recon; sid:200014971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tutp27"; http_uri; nocase; content:"nah.uy"; content:"Host"; http_header; classtype:attempted-recon; sid:200014972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/vimyln"; http_uri; nocase; content:"nah.uy"; content:"Host"; http_header; classtype:attempted-recon; sid:200014973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/vwzsnu"; http_uri; nocase; content:"nah.uy"; content:"Host"; http_header; classtype:attempted-recon; sid:200014974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/:o:/g/personal/jason_jasoncolemanhomes_com/eugtikeijyhdouwl-ipyk7qbc1efrb9kbobz6gtu0f2moq"; http_uri; nocase; content:"netorg3850966-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/:x:/r/personal/ginger_gingerfountain_com/_layouts/15/wopiframe.aspx?guestaccesstoken=gpys8ex7ys1urrzbfeasvlexkodtrovmmcpn%2brsnebs%3d&amp\;docid=1_1882b07b5eb5643d2bdaa63426324ef0e&amp\;wdformid=%7b9bd54af1%2dee16%2d4e07%2d8d62%2d6e9b76e47512%7d&amp\;action=formsubmit&amp\;cid=9adf3e74-8cc1-4e36-b545-c9165fcafde7"; http_uri; nocase; content:"netorg6600800-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bancos/interbank"; http_uri; nocase; content:"nexoinmobiliario.pe"; content:"Host"; http_header; classtype:attempted-recon; sid:200014977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n/fr3iqzycmqk5/b/sharefiles/o/onedrive.html"; http_uri; nocase; content:"objectstorage.eu-frankfurt-1.oraclecloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n/axljdqwgc9tw/b/bucket-boi0/o/..ojonedrive.html#accounts@centrica.com"; http_uri; nocase; content:"objectstorage.eu-marseille-1.oraclecloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n/ax7tpt0dfi6x/b/bucket-20220713-2101/o/seradex.html"; http_uri; nocase; content:"objectstorage.us-sanjose-1.oraclecloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n/ax7tpt0dfi6x/b/bucket-20220714-1031-onenote-sharepoint-verification0220713-0307-onenote-sharepoint-verification/o/sarasavapoint.html"; http_uri; nocase; content:"objectstorage.us-sanjose-1.oraclecloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n/ax7tpt0dfi6x/b/bucket-20220717-1800/o/indexseradon.html"; http_uri; nocase; content:"objectstorage.us-sanjose-1.oraclecloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n/ax7tpt0dfi6x/b/bucket-20220721-0225/o/seradon.html"; http_uri; nocase; content:"objectstorage.us-sanjose-1.oraclecloud.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"oiazeiuiazolme.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?comon%2f=index&amp\;id=2&amp\;tokenize=2d6b164b5c74ceaf5354e4bd9588e82c&amp\;fbclid=paaazocaxdeq8zqj6myxs9pk6nwafsrge0-i_cp5mmzu-gr4srsrurh0wuzn0_aem_ayirjn9j2za_4guicjzh0iyi1hfg8fsr5ygrl9b7xxj9tbxus78zqcfo6fm4qs6vlpbyxs9u8isnxycwnkq742fsta1wqqwdkf_lvurgtpaof-ddwhnhx-qr-iylall9qrm"; http_uri; nocase; content:"omundointeiropet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/download?cid=936f66742226eaf0&resid=936f66742226eaf0%21105&authkey=aitnwnmvuumu2oo"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view.aspx?resid=cd71337cfb2b3ba9!1313&amp\;ithint=onenote&amp\;wdo=2&amp\;authkey=!ajwhinbbsa8ui98"; http_uri; nocase; content:"onedrive.live.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"online-helpchase.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/app/forms/view/zalxyved/a9adea36-d163-4d46-a3de-0e990d86e78e"; http_uri; nocase; content:"online.visual-paradigm.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ions/index.php?email=redacted@abuse.ionos.com"; http_uri; nocase; content:"onlinecasinospark.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"onlinehelpchase.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/:w:/g/personal/lisa_ohalloran_orono_k12_mn_us/ew5u5g4qyatls5vl6tw_qfkb6p4mf5_-uerx77babfo7yq?e=4%3admef63&amp\;at=9"; http_uri; nocase; content:"oronok12mnus-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/34p650jume1"; http_uri; nocase; content:"ow.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200014993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1682449218/156e09d0ea8e294db3474e54a2df1dc9/download.htm"; http_uri; nocase; content:"padlet-uploads.storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ripleychile/formulario/formulario_opt_out/opt_out?spmailingid=46529866&amp\;spuserid=mtm1mjmzntkxntc5mqs2&amp\;spjobid=mjiwmti5njg1mqs2&amp\;spreportid=mjiwmti5njg1mqs2"; http_uri; nocase; content:"pages03.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200014995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/confirmid.php"; http_uri; nocase; content:"pagesupdateidetitysecdtut.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200014996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"paozeia.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2021/02/blog-post.html"; http_uri; nocase; content:"paypal-inc-userupdatenuber7925570844.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/orn.html"; http_uri; nocase; content:"perspectivart.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200014999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-admin/includes/api-irs.html"; http_uri; nocase; content:"pichaapp.africa"; content:"Host"; http_header; classtype:attempted-recon; sid:200015000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/geta"; http_uri; nocase; content:"piscinaveronza.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/juegos-ninos/habilidad"; http_uri; nocase; content:"pocoyo.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-includes/cqwmall/"; http_uri; nocase; content:"ppi.alphaobsdevelopment.co.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200015003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-includes/cqwmall/index.php"; http_uri; nocase; content:"ppi.alphaobsdevelopment.co.in"; content:"Host"; http_header; classtype:attempted-recon; sid:200015004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fia8mx"; http_uri; nocase; content:"ppt.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200015005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fva4wx"; http_uri; nocase; content:"ppt.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200015006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fvakzx"; http_uri; nocase; content:"ppt.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200015007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fvllvx"; http_uri; nocase; content:"ppt.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200015008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d0uv8808qzu0hxnpoqtl"; http_uri; nocase; content:"preferences.convertkit-mail.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cpsess3669307974/horde/imp/dynamic.php?page=mailbox#"; http_uri; nocase; content:"premium57.web-hosting.com:2096"; content:"Host"; http_header; classtype:attempted-recon; sid:200015010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/emailfwd/show.php?usernum=350311855&amp\;formid=3879"; http_uri; nocase; content:"pub5.bravenet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2rc41txe"; http_uri; nocase; content:"pxlme.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200015012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/5p_xnr4w"; http_uri; nocase; content:"pxlme.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200015013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ewqwwwsl"; http_uri; nocase; content:"pxlme.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200015014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/in1b4ru"; http_uri; nocase; content:"pxlme.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200015015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/izircqqd"; http_uri; nocase; content:"pxlme.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200015016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/r6wxsyai"; http_uri; nocase; content:"pxlme.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200015017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uwxh38rr"; http_uri; nocase; content:"pxlme.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200015018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ytmc2hww"; http_uri; nocase; content:"pxlme.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200015019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/zv8d_zyc"; http_uri; nocase; content:"pxlme.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200015020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hixeto"; http_uri; nocase; content:"qr.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bczdkg?userid=ad1e2wno"; http_uri; nocase; content:"qrco.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200015022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bd5q48"; http_uri; nocase; content:"qrco.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200015023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/j3dxsp1"; http_uri; nocase; content:"qrs.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200015024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jeh2aebbsh97"; http_uri; nocase; content:"quip.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/qv7malu8n7cz/you-have-some-messages-pending"; http_uri; nocase; content:"quip.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"raketcoeosncsaasecasorsed.caokarsoasoceoseccsoutsen.xdwpdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"raketcoeosncsaasecasorsed.caokarsoasoceoseutsen.xdwpdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"raketcoeosncsaasecasorsed.caosarsoasoceoseccsorkutsen.xdwpdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"raketcoeosncsaasecasorsed.caosarsoasoceoserkutsen.xdwpdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"raketcoeosncsaasecasorsedccao.arsoasoceoseaasrkutsen.xdwpdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"raketcoeosncsaasecasorsedccao.arsoasoceosearkutsen.xdwpdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"raketcoesncsaasecasorsed.caokarsoasocoseccsoutsen.xdwpdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"raketcoesncsaasecasorsed.caokarsoasocoseutsen.xdwpdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"raketcoesncsaasecasorsed.caosarsoasocoseccsorkutsen.xdwpdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"raketcoesncsaasecasorsed.caosarsoasocoserkutsen.xdwpdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"raketcoesncsaasecasorsedccao.arsoasocoseaasrkutsen.xdwpdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"raketcoesncsaasecasorsedccao.arsoasocosearkutsen.xdwpdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"raketoncasord.aasccsorkutsen.dsyau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"raketoncasord.aasccsorkutsen.nmmuu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"raketoncasord.aasccsorkutsen.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"raketoncasord.arkccsoutsen.dsyau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"raketoncasord.arkccsoutsen.nmmuu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"raketoncasord.arkccsoutsen.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"raketoncasord.arkutsen.dsyau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"raketoncasord.arkutsen.nmmuu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"raketoncasord.arkutsen.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"raketoncasordceo.aasrkutsen.dsyau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"raketoncasordceo.aasrkutsen.nmmuu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"raketoncasordceo.aasrkutsen.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"raketoncasordceo.arkutsen.dsyau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"raketoncasordceo.arkutsen.nmmuu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"raketoncasordceo.arkutsen.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"raketonccasecasord.aasascoseccsorkutsen.leinfu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"raketonccasecasord.aasascoserkutsen.afgefu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"raketonccasecasord.aasascoserkutsen.aqnrdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"raketonccasecasord.arkascoseccsoutsen.leinfu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"raketonccasecasord.arkascoseutsen.leinfu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"raketonccasecasordceo.ascoseaasrkutsen.aqnrdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eic3kf"; http_uri; nocase; content:"rb.gy"; content:"Host"; http_header; classtype:attempted-recon; sid:200015060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dwi5d?/pages/services/2022"; http_uri; nocase; content:"rcl.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200015061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mw80e?./help-accountcenter-service.gtempurl"; http_uri; nocase; content:"rcl.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200015062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pztsj?./accountcenter-service"; http_uri; nocase; content:"rcl.ink"; content:"Host"; http_header; classtype:attempted-recon; sid:200015063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/medical?pc_url=https://health.usnews.com/doctors/li-lei-1012630&securl=ghy1rdnmwlqytqu2rfrhtf27kllqk76w&type=wap&wap_url=https://mail.ionos.com/"; http_uri; nocase; content:"readmodel.m.sogou.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"reamaam.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/g8npsq6"; http_uri; nocase; content:"rebrand.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200015066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/o1lz8r3/?email=registrar@nameshield.net"; http_uri; nocase; content:"rebrand.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200015067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/q56jwtcw7wa-indiesbxopqzx/#william@nabaza.com"; http_uri; nocase; content:"rebrand.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200015068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/home.php"; http_uri; nocase; content:"rectifywebwallet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"redatofadesafe.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"reikreitel.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/6e9zk5"; http_uri; nocase; content:"reurl.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200015072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/g2emzn?coinbase?shiny"; http_uri; nocase; content:"reurl.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200015073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/xeknoz?confirmation"; http_uri; nocase; content:"reurl.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200015074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/xgmxr1"; http_uri; nocase; content:"reurl.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200015075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/login.php"; http_uri; nocase; content:"review-new-recipient.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2d0jazx1eky5/click-here-to-verify-your-email"; http_uri; nocase; content:"rezunz.quip.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2021/02/blog-post.html"; http_uri; nocase; content:"riderctposten.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-includes/widgets/ea8a/postch.php"; http_uri; nocase; content:"robinettearchitect.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-includes/widgets/ea8a/redirect.php?id=7c18c315d71119489192f48f2b84ad73"; http_uri; nocase; content:"robinettearchitect.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/rocks/live-resthyip/"; http_uri; nocase; content:"rockstheme.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/920970d0"; http_uri; nocase; content:"rplg.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-content/wflogs/wfcrop/geolite/femsinoa/reprovadoer/zieixcgerghfv.htm?eer=info@vanhilten.eu"; http_uri; nocase; content:"rsmpoly.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200015083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1c3ep"; http_uri; nocase; content:"s.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200015084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1c8vs"; http_uri; nocase; content:"s.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200015085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1c93f"; http_uri; nocase; content:"s.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200015086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1ceyc"; http_uri; nocase; content:"s.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200015087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1chmq"; http_uri; nocase; content:"s.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200015088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1ck7d"; http_uri; nocase; content:"s.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200015089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1cno4"; http_uri; nocase; content:"s.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200015090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1cqpr"; http_uri; nocase; content:"s.id"; content:"Host"; http_header; classtype:attempted-recon; sid:200015091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/~pixlge1/home/?utm_medium=social&utm_source=heylink.me"; http_uri; nocase; content:"s23.proserv.ge"; content:"Host"; http_header; classtype:attempted-recon; sid:200015092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/appforest_uf/f1657754163749x798387482955685100/index.html"; http_uri; nocase; content:"s3.amazonaws.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/appforest_uf/f1658277135994x443509091878453440/arsenal.html#example@example.com"; http_uri; nocase; content:"s3.amazonaws.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/appforest_uf/f1658314454815x169790690412066080/microsoft.html"; http_uri; nocase; content:"s3.amazonaws.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/appforest_uf/f1658357287235x251427031444372960/default.html"; http_uri; nocase; content:"s3.amazonaws.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/appforest_uf/f1658390008307x462206989531643650/0micr%40s0ft.html"; http_uri; nocase; content:"s3.amazonaws.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/lynmarestate.com/irishdrilling.ie.html"; http_uri; nocase; content:"s3.us-east-2.amazonaws.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/zssr/freshpag/index.html#"; http_uri; nocase; content:"saa.ddo.mybluehost.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200015099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"sacaiseoncassed.ascsord.opxucu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"sacaisseoscncasseseid.casocsord.opxucu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"sacaivseseosncasseid.cccaseasocsord.opxucu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"saisceon.saisecon.iwcyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"samirsonte.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/p/la-banque-postale.html"; http_uri; nocase; content:"sandert12.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"sasaion.sacasison.bipydu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"sasaion.sacasison.ipcvku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"sascaiion.sacasion.bipydu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/macros/s/akfycbxldfmsdlmc1xmyfvmhpijk0qxsnxurlh95jzz3qcvmodhollh-cgwk3ql47_ntzyajzw/exec"; http_uri; nocase; content:"script.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/login"; http_uri; nocase; content:"sculpturecrown.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"sdzakfahz.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"sefonta.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/p/postenno_9.html"; http_uri; nocase; content:"seonewsservic.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/:b:/g/personal/jean-claude-fernandes_sgdb91_com/exk2a_c6xsxouopoew83oxib65oghw_co2bz33les1rdxw"; http_uri; nocase; content:"sgdb91700-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/23456668495783/login.microsoftonline.htm"; http_uri; nocase; content:"sgp1.digitaloceanspaces.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/browngold/sharon.htm"; http_uri; nocase; content:"sgp1.digitaloceanspaces.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/j7trucking467/3sndftr.html"; http_uri; nocase; content:"sgp1.digitaloceanspaces.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1nf2c-aodrjqdzggr2mg9xaevrta"; http_uri; nocase; content:"share-eu1.hsforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/11c1i3ucrsjaeqnyxinop6ad5rxo"; http_uri; nocase; content:"share.hsforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1fni_ent2sao6wqv0vzdn7g8nl9d"; http_uri; nocase; content:"share.hsforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1onniqroftvoytwpvbgznvgd5749"; http_uri; nocase; content:"share.hsforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1whluifnasr6s4ov9skogswd5n96"; http_uri; nocase; content:"share.hsforms.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/basic.php?k=d63621ef3dc01735479befc13f97ec7fdb68991d"; http_uri; nocase; content:"shared-document.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/nqgu1"; http_uri; nocase; content:"shorturl.at"; content:"Host"; http_header; classtype:attempted-recon; sid:200015124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ful6dt"; http_uri; nocase; content:"shrtco.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200015125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bq/cap/"; http_uri; nocase; content:"shushtem.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2g00jrdaghf4l1dqtoss72d1qg5a9i1g64ui9rl4sd53kmmhbnbmnv0"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2g0e50tr72n951lk1nt3c9p0jbtroph0ti9e83l4prhc74e40f6oid8"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/_awexr7idnuz0hz5s4ktjo9fkh3zkleoiybwyewhf7h5fw"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/aacq4gz2aiukwj8c8oaf04yk8f7h0zmwvx39zmhmjdkj1a"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/baabeasnphvhpauyy3zxn3wwd6cagio6od7owxwscdok7w"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eaabmdbviobuu2fxtwg3ru8pqv36rdr7zx1i4rddd3vqog"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eaadjv6k0xqfeu7therfzv6ponqvilgadbt_gqxgtxyoyq"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eaagsw-nlrc66e1hpq0whe_a-lofagscuyplmortycqefq"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eaaqsg5_9iva54fi3tzu9_iqylva4ujcbvq3z0omboj7dq"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eaastcf1pfu3ffomevikn9xe9_af09mioelpjp7l55jy5q?utm_source=hancockwhitneyonline&utm_campaign=hancock&utm_id=hancock&utm_term=hancockwhitneycustomers"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eaastcf1pfu3ffomevikn9xe9_af09mioelpjp7l55jy5q?utm_source=hancockwhitneyonlineverification&utm_campaign=hancockaccount&utm_id=hancockwhitney&utm_term=hancockwhitneycustomers"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eaayz0hasnkj1mrj6cyjp_a64oat80ocfwq3vb_a9huzlg"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eabibfvu2cs824kdijdrs-n_zwu-ye4drkasdgdocktsta"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eacawghjnlzemsxieil3yn8btdv9m4gnlxo-xxvhuxwrcw"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eacv0mmri_rxycvx_qfedg3nzkqodverbvcun2lfcxzj-a"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eacv8eymygjay6h6_pitmsmbkiw_ruhaq1g9eocii9bmzq"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eacv8eymygjay6h6_pitmsmbkiw_ruhaq1g9eocii9bmzq#@yorku.ca"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eacxxjr4ta8beeoce3m-fzgq04nnc6s7zizyomkmef_qla"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ead4juhlesygjwazplr-cxx99hkkskuvw5hx9zxg7g4t8q"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ead6vbhooi4cozjsf0wnjggrswic5ywetruqwoqpikwngg"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eadbonbwizmt2xgnwrvm3j6h_vnddein-alzf7l-4itbew"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eadfexmfggpqfklnrqixvqwlojubedcvykluh2_yymngta"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eadfexmfggpqfklnrqixvqwlojubedcvykluh2_yymngta/"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/eadipo1vhrip2qjqkd-tt1uqhicviodqrr3hhpwpn9ixea"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/faciscqa09jxycwkbpjzyjop3c61o64ew9tevgcgtlma4a"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/faf8cg2rpvscpvalvg1oertf89f8kya0wehkz3xazr7uvq"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/faki21b9qmz6si1i_h7wspjpecwrameiv_knk1soznvc1a"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gaa0cfcgr6qkprmqvqeudfi69urifoecxyutbrfx253kfq/"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gaa5uvgflvjjwksi1otxdsznlbizos_g7nuwcwa3ufocya"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gaasywujnyyewvui-iafkbprby1hbljtfatlp2t8b9c4qg"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hab1o3f_xx8ecwsogldqbnszqsr8a0-iimcctz-rnvqxag"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/habjm_bxymouybq6_q88jlx0vhqv-mfygx5v9o4udapkxq"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/iabrkq71fx9kwt1ugd5ebzfodrqe0oj6pe_tdpraa3ziyw"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jab30xxkoo7q4kjxbbnrjkikup0fnvsjadvpzfqp1dndqg"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jadm7-1semqhom-kpwo0xh_ouukp0kt4gegeo6jeqzcowa/"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/oaa2utbwfjhvgaqgdc3mm5bxcq3-un-uf4mzwans2ohl4g/"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/oabbhibfmmcmxdmlv6tksw7c1dspwo422bg8ywqf08mhog#vanicekp@utia.cas.cz"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/oacfunss5krz1awhr7fls9jqawatbtwfpnhvzonygenirq/"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/oaczwdtzqbfwuqvvq5zk2m-t6ejhkyeobcg9zkgyz5xbpg"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/oadspjpjj4ltsrnev-jnlqztivtqsu707nmkvva5fveaqa/"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/paalxx9jzo9d4-arsiu0cwarxzjqp3_xgif6wf809u5jgq"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pabpc61ckznq8wvri_ugn3twjmdwzta77bgmkqqfhjgprw"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pabwdqgxc9wagauq0qqzvx_wyn7wpqu9wln57-ojt52psa"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pac9t7rudgvfthiaqg11zl-q1hssqagrvbdjpm5zpjc97w"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pacocuuqawicmv_zlzh5hfwdbmyl4qjwzvtavl7tcgqsug"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/padeuxm3zf5cg9sin6ayaxbmykm7hzzj7ipuicjpqh1r5w"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/padndzisalazp66ecbdyn_s1lvngzjvtyktshqifdrk23q"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pah7bxs2cnls-tt7zljiprv5un2bjaxndqisben9wiwalg"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pg04jsc12uld41irj4ja8sgeb8l1k80lgdbe9dq1pkgjr0rul8sbn48"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/vaafra-1zd-kzsiurysc9payjgwrxcfnr2_ng-w5jv1jrg"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/vaazotfu1th94uwybvr_yft_tg62h4cy0jthic8atcsh5a"; http_uri; nocase; content:"siasky.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200015177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/publish/xhrdvc"; http_uri; nocase; content:"simp.ly"; content:"Host"; http_header; classtype:attempted-recon; sid:200015178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a/sy4norton.com/setup/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/amricalturs.net/download4/microsoft-office-365"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/metamask-ios.com/metamaskchrromeextension/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/metamask-ios.com/metamasklogin/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n12-netempresarial.com/empresa-nerd-n12/in%c3%adcio"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/newservices.website/orange-mobiles/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/newservices.website/service-reglement/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/newservices.website/service-reglement/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/site/e9d24c72/23524457"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/site/habbotuttogratis"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/site/habbotuttogratis/assignments"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/site/libretyreserve"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/site/libretyreserve/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/site/protectedinmprovmnt44/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/site/safetycheck427064200647221/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/site/verifycheckpointpaqes/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/019businessusersbt782btsignin/secure-update-com"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/08ie-securepage-facebook"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/09securebusinessusersonly-/secure-bt-com"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/0iey-securepage-facebook"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/0range-bank/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/12noreplybtuserconnect365offic/secure-bt-com"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/1mailxverificatio/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/2-orangebank-salva/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/3-orangebank-vetch/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/302dir/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/3254798fr78/uigiugi"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/4-orangebank-toto/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/565f34/microsoft-office-365"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/65h7t65ygtdw5f4/bt"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/65q-securepage-facebook"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/98w72securebusinessbt-01/secure-update-com"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/a3y-securepage-facebook"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/abonnevocalweb/accueil?authuser=5"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/abuse-privacy/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/access-office-aud-msg-us/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/access-office-docxpdf-call-net/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/access-salesorder/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/access-voice-mail-pay-us/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/accs-office-ml/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/accs-p-o-us/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/accsoffice-usa/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/activationagrisecuriplus/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/adrianoferriani/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/alert-app-pages/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/amporangefr/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/amsohappy/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/app-mobile-uuid/recovery"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/appli-ob-securite/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/appli-ob/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/appli-obank-serv/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/appli-scur-obankps/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/applkactu/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/apps-authentification-forte-ob/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/apps-mbl2/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/apps-obank-apli/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/apps-secure-ob/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/apps-securite-ob/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/aqwsas"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/asdfghjklhgfdsdfgh/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/atendimento-online-emissao/in%c3%adcio"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/atendimentomarnobre/p%c3%a1gina-inicial"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/att-home/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/att-mail-update/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/att-managements/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attemailfox7/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attemler7/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attfeatures/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attlattlattlatt/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attmailcustomerupdate/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attmaillogservise/attmail"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attndattndatt/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attnet-104921/att"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attnetli/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attnetlogsignmail/att-net"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attnetlogsservce/att-net"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attonline00/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attserv111cust/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attttstttegegrsksw/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attudnie/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attupdateobo/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attweb22/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attweblysiteupgrade/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attyahoomail7/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/attyahooohroffice231/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/authen-secure-obank/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/authentification-apps-ob/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/authentification-ob/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/authentification-orangebank-eu/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/authentifications-ob/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/awspage"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/background-in"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bacopremolista/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/baltimoreassessoria"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/banquepostalebanqueetassurance/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bbroadband110/home?authuser=4"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bbtbroadband/home?authuser=9"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bcp-mille/home-page"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/benachrichtigung-sparkasse/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/biorange/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/broadbandplc/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bt-2022-user/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bt-cloud-voice-review-voice/bt-voice-cloud"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bt-clould-preview000112/voice010101010bt-cloud?authuser=8"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bt-pdf-receipt-payment/www-bt-pdf?authuser=8"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bt-users/secure-business-bt-com"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bt-voice1010010/bt-voicemesaage10120201002?authuser=8"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btbillreview/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btbraodbandteam/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btbriadbandteam/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btbroadbandlin/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btbroadbandplc/home?authuser=7"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btbroadbandplc1/home?authuser=1"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btbroadbandteam/home?authuser=5"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btbroadbandweb/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btbroadli/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btbtbtbtbtbtcomm/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btbusinessx/bt"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btcloudpaymentinvoice202000/httpsbtcloudvm-voice-new?authuser=1"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btcloudvoice-mv0001/home?authuser=3"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btconnectbusiness/btconnect"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btconnectmailserver/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btconnectsecurebusinesbtcom/bt-connect"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btee0/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btem/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btemailwebmailer/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btintern/bt-com"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btinternet42day/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btinternetco/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btinterneter34567/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btmailerupdatee/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btmv-voice-notice011/btvoicemessage?authuser=8"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btmv/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btnvm-urgentnotice/btvmnew-note?authuser=1"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btserver10/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btservicebill/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btsuporteamsup/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bttbriadbandteam/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bttbusinesssss/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bttelecom/home?authuser=1"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bttelecomm-/home?authuser=5"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bttelecomm0/home?authuser=2"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bttelecommication/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bttelecommservice/home?authuser=5"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/bttelecommunication-plc/home?authuser=2"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btuiytretyudfgjh/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btwebmailww/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btwebsuppor/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btweeb/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btworkking/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/btworldwide/home?authuser=4"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/businesbtnewbroadband-hub/update-bt-com"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/business-btbtb-office365/secure-bt-business-com?authuse%20r=3"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/business-btbtb-office365/secure-bt-business-com?authuser=3"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/businessbtxpress/update-bt-com"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/capitaloneloginus/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ccjkc/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/certiauthavril/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/cgnvzmx/att"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/chamekesa/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/chamekesa/accueil?authuser=3"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/chamfare/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/charlisto/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/clickpagenewlogin2021"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/clxyxsnh/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/coinsbuysellswapcryptocurrency/?fbclid=iwar2isl9xfxxgcxtftml2hmcl_dglhshlkfkpdotycyqu-qjqqfdqm9whtfm"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/comfimobiekdofl/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/community-pages-app/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/condado-duo-luis-pagan-/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/confirmation-orangabank/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/confirmationacces"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/confirmationacces/verify-pages"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/connectionperdue/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/connectolo/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/connectsvqq"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/control-service/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/controlpanel-ovh?/48700315fr640w648"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/couldie/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ctz03"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/currentlyserver/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/cvrpd/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/d-aps-orge-secure/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/dambt/home?authuser=6"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/damilolwas/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/damilosadde/home?authuser=7"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/dasbvmk/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/debloquagedescompte/page"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/dfghjhckuyf/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/dfghjhl/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/dgjhjjojhgffg/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/dhddfhdfhcom/att"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/directionobweb/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/dispo-obankweb/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/divsec20/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/dkdfkazii-ofoqisjaz1wk/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/dkekkeole/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/doelza/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/dshrkuoiuhgkjkjlkmjyhhfhj/bt"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/eaglemaddez/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/eikp-securepage-facebook"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/erydkjsdkhfgjfhjdkh/bt"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/es-pace-clien-ts/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/espa-ce-clien-ts00/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/espa-ce-de/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/espace-orange-vocal/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/espace-vocal-orange/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/espace-vocalorange-ref0325/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/espace-vocalorange-ref0325/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/espaceclientscuritvfvfdsvsf/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/espacemessagerieorangesms/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/estomcasting/accueil?authuser=1"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/etyajdnxnskoeprlwyaxbdhfkrituy/btconnect"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/exodus-wallet-shared-rewards"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/fa-ctu-re-es-pace00/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/fa-ctu-re-es-pace00/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/fabiodhouman"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/fac-tura-tion-esp-ace05/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/factu-re-clients/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/fantasticpage-in"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/fatct-ure-es-pace01/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/fatherplac/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/fatu-ration-esp01/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/fcg133/att"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/feelblessed/bt-business"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/feriousca/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ffduefuefsbc/att"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/flmkgknzklfgklfgk/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/form-recovery/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/form-recovery/details"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/france-banque/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/frdfhhh/yahoo-mail"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/fscdsh/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/fssghsfd/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/gajiview/yahoo-com"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/gdhbfcxzx"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ggfhftwyjfj/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/gmxmailerfttfd/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/gmxupdate/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/gsdeaq"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/h6wrjhcs6tt9fwphome/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/hbxchx"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/hccwc/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/hfggdfyhcom/yahoo-mail"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/hfgggggggggggggg/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/home-bt-updates/bt-com"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/home-pages-recovery/details"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/hommem-loggiinnformm/home?authuser=2"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/httpbtbroadband/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/htvvss/home?authuser=3"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/hvgfdcftfttf/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ii-securepage-facebook"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/inf0ssgss/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/infoline439pent0line/accueil/untitled-page/fdsls32?authuser=6"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/invoice-payment-pdf/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/invoicehomepdf/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/jcnvvn/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/jdvdksf/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/jio-tower-installation-apply/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/jmjmnhvdc/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/jnbhgv/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/juif00012/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/kjhydc6yh/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/kjnbhgvcfd/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/koiuld2dkjcxnjk2s/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/landbankredirect/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/leafadd/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/leafpadrode/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/lidl-bg22/bg?fbclid=iwar3vyju-ddafnwfna5hgyotzwb0pjkbcfmwydmyrixienrmngx7gzksmlom"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/line01-centre/accueil?authuser=2"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/lkdiur24/accueil/secureli20"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/lkoeir3190/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/llllogin-home-pageaa1/www-btconnect-com"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/log-inpagenew"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/loltym/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/magazineluiza22/promo%c3%a7%c3%b5es"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/mailcustomerservices/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/mailtoh/home?read_current=1"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/mailyahooservicesverifynow/home?read_current=1"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/mallhitoh/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/mallofuaq/halaman-muka"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/manager3-controlpanel-ovh"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/maxatserv/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/maxmaner/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/mcwdbvefjberjrwgnwriviwr/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/messagerie-vocalorange-gms-mms/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/messagerie-vocalorange/accueil?authuser=2"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/messageriehtlmxccvsdfvf/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/messor/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/mldof"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/mmanuel/attyahoo"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/mndirilivin-online/verifikasi"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/mnoko"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/mobile-apps-pages/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/mobile-redirect-system"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/monbonusclicetmoi/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/mssft22/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/mv-voicepage/home?authuser=8"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/myatt-home/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/mycoinwallet/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/n12-acessologinempresanet"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/n12-acessologinempresanet/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/name29/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/necrologieinfosfroravocal/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/nefsuddma/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/new-service/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/newbtmissedcall/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/newuploadpage"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/newvoicemail/home?authuser=1"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/nextprojectpage"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/nextprojectpage2022"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/notice-pagesecure"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/noticeplaypagenew2021"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/noticepublicpagenew2021"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/noticeservice2022"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/notifcationnoticesystempage"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/nouveau-sms-message-vocal/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ob-certifier/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ob-identifweb/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ob-seccurite/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ob-securite-/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ob-securite-eu/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ob-securite/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ob-securites/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ob-service/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ob-verifie/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/obank-authentificat-forte/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/obank-securit/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/obespaceweb/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/office-com-mail/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/office-srv-cnt-us/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/offiice-voice-com/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/online-zkb-0"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/online-zkb-1"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/online-zkb-2"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/onlineemail890/home?authuser=1"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/onlinefifthercheckaccout/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangbnk/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orange-b-securite/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orange-espace-client1/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orange-facture1/admin"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orange-forfaits-et-mobiles"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orange-forfaits-et-mobiles/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orange-forfaits-et-mobiles/accueil?authuser=1"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangeb-190/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangeb171/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangeb221/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangeba/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015525; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangeban/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015526; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangebank-22/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015527; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangebank-r/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015528; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangebank-sc/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015529; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangebank-secure-secure/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015530; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangebanksecurite/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015531; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangebannk/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015532; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangeclient2/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015533; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangeclient2/fact458"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015534; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangehtmlcofirmationqcdsvcdvf/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015535; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangeibank/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015536; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangeinfosvocalnews/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015537; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangemms/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015538; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangemyconnect/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015539; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangesecurishtmlvnc/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015540; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangesupp"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015541; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangesupp/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015542; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangevocalwebmaildigital/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015543; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/oranggebank/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015544; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/orangiebank/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015545; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ormas/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015546; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/p2j/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015547; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/pagenewlogin2022"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015548; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/paissnsns/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015549; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/pass-press/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015550; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/pass-securit-societe-generale/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015551; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/pay-ez-vo-tre-fa-cture/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015552; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/pay-ez-votre-fact-ure10/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015553; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/pay-ez-votre-fact-ure10/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015554; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/paypal-customer-services/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015555; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/paypal-loginn/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015556; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/pfherjwlsnmcyelwudy/home?authuser=3"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015557; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/pleasecheckpoint2021"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015558; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/pleaseclickplaypagenew"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015559; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/pleaseclicktopage"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015560; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/postacerticodplusaccaccueil/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015561; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/preferences-coordonnees?bredbanquepopulaire.fr/authentification/transactionnel"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015562; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/private-bt-policy/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015563; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/projectupdatepage2022"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015564; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/protonmailservice/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015565; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/pstbrand"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015566; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/pushfarcot/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015567; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/quickmailer/yahoo-com"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015568; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/quickteamservice/yahoo-com"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015569; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/r64t9/security-page-recovery"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015570; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/recatss/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015571; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/redirect-acctpages-uuid/details"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015572; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/redirectme-to/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015573; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/redirectmybank/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015574; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/regionglobaleactivate/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015575; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/regionphfrancecentrerelations/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015576; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/regionphp/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015577; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/regl-ement-fac-tu-re/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015578; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/review00zzz01/bt-home-com"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015579; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/reviewappspagerviicee/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015580; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/richcoff/bt-business"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015581; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/rimekahsdjg/summary_page"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015582; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/rnorangefisrt/12547op"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015583; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/rvcefte/recovery-suport"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015584; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/sadcfasdc?facebook-security/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015585; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/sadfrsg/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015586; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/salimkaso/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015587; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/saudipost-spl"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015588; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/sbcglobalm/home?authuser=1"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015589; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/sbcglobalmaillerrrr/att-net"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015590; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/sbcglobalnetbellsouth/att-yahoo-mail-com"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015591; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/sbcweb22/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015592; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/sdbdbdbdbd/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015593; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/seccure-business/secure-business-bt"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015594; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/section-ob-web/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015595; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/secure-bt-homevoice01010120/home?authuser=8"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015596; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/secure-ob-/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015597; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/secure-ob/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015598; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/securebtusers/businessbt"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015599; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/securenoticepage2022"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015600; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/securiplus0101/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015601; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/securite-app-obank/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015602; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/securite-ob-service/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015603; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/securite-obank/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015604; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/securitee-ob/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015605; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/securites-ob/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015606; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/securree/home?authuser=1"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015607; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/securritee-ob/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015608; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/seecurebusiness-/bt"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015609; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/serv-appli-ob-fr-2022/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015610; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/serv-appli-obank-fr/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015611; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/serv-espace/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015612; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/serv-ob-authentification/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015613; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/serv-ob-securite/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015614; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/serv-ob/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015615; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/serv-obank/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015616; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/serveur-communication-box/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015617; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/servi-orangbank/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015618; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/service-apps-obank/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015619; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/service-orangebank-fr/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015620; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/service-orangebank-securi/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015621; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/service-securite-ob/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015622; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/servicenewlogin"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015623; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/seuysihofficebtbusinessbrir/bt"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015624; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/sgdfgetf/att"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015625; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/sharepointofbandhan/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015626; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/shgeudh/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015627; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/sitatt/home?authuser=3"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015628; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/sitgandii/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015629; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ski03/strona-g%c5%82%c3%b3wna"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015630; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/soeyankandi5/bt-business"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015631; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/szdgsdhgd"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015632; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/taffac1/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015633; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/terlenaaja"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015634; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/texaschildneurology/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015635; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/thenewstartpage2021"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015636; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/theservvvvvvv11ajw2/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015637; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/titat6867gghm00/%d8%a7%d9%84%d8%b5%d9%81%d8%ad%d8%a9-%d8%a7%d9%84%d8%b1%d8%a6%d9%8a%d8%b3%d9%8a%d8%a9"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015638; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/tq4rdkn8/security-page-info"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015639; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/uiora"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015640; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ukhdggdfgd/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015641; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/update-allreadypage"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015642; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/updatesecure"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015643; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/updatingnewpage"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015644; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/upgrade-bt/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015645; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/usaconnectingcom/att-yahoo"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015646; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/usaoush/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015647; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/utereue/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015648; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/utututttu/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015649; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/uuhqv/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015650; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/uzl2kop/?faacebook.com"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015651; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/v-ob/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015652; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/venmo-loginusa/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015653; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/verif-ob/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015654; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/verificat-mobi-obank/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015655; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/verificat-mobile-obank/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015656; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/verificat-orangeb/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015657; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/verificati-ob/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015658; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/verifmail03/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015659; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/vfbjf/btconnect"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015660; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/vfdffktt/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015661; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/vghgn/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015662; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/viewyournewbill/bt-business-btconnect"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015663; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/viewyourrbilll/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015664; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/vjsdhdfidjasi/btconnect"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015665; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/vkjjjerljjarea/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015666; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/voipnotevocale/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015667; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/votre0101/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015668; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/votre04/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015669; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/votre1/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015670; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/votre12/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015671; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/votreone/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015672; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/walletliveconnect/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015673; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/watchingregard/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015674; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/webespaceclient-ref8/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015675; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/webmailbt/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015676; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/webmailbt23/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015677; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/webmailnotification093/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015678; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/weebmail123/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015679; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/weelcomsign/accueil"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015680; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ws0l"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015681; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/xcccjcdhasks/btconnect"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015682; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/xmicrosoftoficew/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015683; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/xvhfefef/bt-business"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015684; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/xxbmicrosoft/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015685; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/yah000/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015686; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/yah00mall/home/"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015687; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/yahoo-mail-verify/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015688; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/yahooend/yahoo"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015689; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/yahookwhjf/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015690; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/yahoolip/yahoo"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015691; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/yahoomailactivation"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015692; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/yahoomailconfirmination/home?authuser=9"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015693; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/yahoomailingdesk/yahoo-com"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015694; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/yahoonice/yahoo-com"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015695; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ydkyf/yahoo"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015696; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/zkb-online-3"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015697; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/view/ztt5zazu/home"; http_uri; nocase; content:"sites.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015698; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"smcb-ccamd.scvau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200015699; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"solatresont.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015700; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/info.html"; http_uri; nocase; content:"solucionesachgt.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015701; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"soufatanse.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015702; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"soufritont.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015703; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"soufsont.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015704; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cmgm7at0l2"; http_uri; nocase; content:"sparka-finanzinstitut.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015705; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/5qntkemqip"; http_uri; nocase; content:"sparka-sparen-leicht.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015706; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/:b:/g/personal/joni_balli_springfield_k12_or_us/eql-lhqmbk9dqecdkkbyookbz0vsc-sscfnnsqgnr2ttda?e=4%3afn0bm6&amp\;at=9"; http_uri; nocase; content:"springfieldsd19-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015707; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/realsecure/main.html"; http_uri; nocase; content:"sreelakshmient.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015708; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/:b:/g/personal/mandyb_steiner_co_za/exxq1passetnrojoe83fzboboxufoggwb7uvmyfqbionla?e=4:su8jhq&amp\;at=9"; http_uri; nocase; content:"steinercoza-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015709; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-includes/simplepie/absa2022/betv/index.php"; http_uri; nocase; content:"steveporterentertainment.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015710; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-content/themes/twentyfifteen/css/read/chinavali/index.php?email=jsmith@imaphost.com"; http_uri; nocase; content:"stolizaparketa.ru"; content:"Host"; http_header; classtype:attempted-recon; sid:200015711; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1lordman1man3/kelmanco.html#email=info@domain.tld"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015712; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1lordman1man3/oscman.html"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015713; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1lordman1man3/oscman.html#email=info@domain.tld"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015714; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1lordman1man3/oscman2.html#email=info@domain.tld"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015715; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1lordman1man3/oscman2.html#user@calstatela.edu"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015716; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/acc03lzzl4m3izm03iauserpowa.appspot.com/index.html#user@calstatela.edu"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015717; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/algebraic-pact-316913.appspot.com/index.html#jbell@legalshield.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015718; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/anaagc040gdyacgd0dyuser.appspot.com/index.html#user@calstatela.edu"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015719; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ciat3tdtttd53c3e5userp.appspot.com/index.html#jr@legalshield.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015720; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ciat3tdtttd53c3e5userp.appspot.com/index.html#paul@legalshield.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015721; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/clientid4dunptjlryzrift3nrlomi160gqntzgznajujcnbszq8w/index.htm"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015722; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cmc111/chaidon.html#a@b.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015723; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/dhngw6p6rwrwnuv6vnuse.appspot.com/index.html#brianvillacarlos@legalshieldcorp.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015724; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/g58t3e588ddgmdeddauth.appspot.com/index.html#jim-shelvy@legalshield.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015725; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gu1r0utjruhjkukrxhauser.appspot.com/index.html#user@calstatela.edu"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015726; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/https3a2f2fofficeuser2fowa2fresourceopenidmsdclientid727c9d/index.html?authuser=0"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015727; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/indettn/oscman2.html#cert@soc.tdc.dk"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015728; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/indettn/pdflmanco.html#user@calstatela.edu"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015729; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/indettn/zdewaman.html#example@example.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015730; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/kkkqkl633qn6kq3lqssiiddnenen.appspot.com/index.html#jbell@legalshield.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015731; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/kkkqkl633qn6kq3lqssiiddnenen.appspot.com/index.html#t.voit@legalshield.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015732; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/logon_id63757945b-32c6-49b0-83e6-1d93765276e7/"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015733; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/logon_id63757945b-32c6-49b0-83e6-1d93765276e7/index.html#martin.manasek@ruk.cuni.cz"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015734; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/logonservices8g7gs65gs9bs66vds7bd9nd/index.html"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015735; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/lttna/zoscman414.html#user@calstatela.edu"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015736; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/maintainancecomponeta.appspot.com/aliexpressautoindex.html#dan@danaxtell.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015737; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/maintainancecomponeta.appspot.com/index.html#a@b.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/maintainancecomponeta.appspot.com/kayindex.html#eimaste@stinpriza.org"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015739; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/maintainancecomponeta.appspot.com/myautoindex.html#example@example.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015740; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/maintainancecomponeta.appspot.com/myofficeindex.html#@yorku.ca"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015741; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/maintainancecomponeta.appspot.com/myowngeneral.html#eimaste@stinpriza.org"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015742; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/maintainancecomponeta.appspot.com/newkaraindex.html#a@b.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015743; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/maintainancecomponeta.appspot.com/newmineindex.html#user@calstatela.edu"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015744; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/maintainancecomponeta.appspot.com/webappindex.html#example@example.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015745; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/owuddqd9dqqdddq9qd0caerq.appspot.com/index.html#stevewilliamson@legalshield.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015746; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/projerroro0h5j5ro0jrrj.appspot.com/index.html#user@calstatela.edu"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015747; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/q90qqqar22r229r292euser.appspot.com/index.html"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015748; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/q90qqqar22r229r292euser.appspot.com/index.html#user@calstatela.edu"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015749; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/qaqonqfaqvq0fni33q0x.appspot.com/index.html????dddd"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015750; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/riltool/mrkautoindex.html#a@b.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015751; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/rrdar99rt9qraraq99euser.appspot.com/index.html#user@calstatela.edu"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015752; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/s0pts0apttxpp00atarrauth.appspot.com/index.html#user@calstatela.edu"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015753; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/sqlseiceteroeswalesuserw.appspot.com/index.html?dd9uj&amp\;rip=1&amp\;nojavascript=1&amp\;ifkv=au9nccwgqgxybveyj_rmt1ijh5qqlfd7xhs9ssn0ocwja5n3jm1gnfvdcuhslngz3y67_oax8ufr&amp\;followup=https://storage.cloud.google.com/sqlseiceteroeswalesuserw.appspot.com/index.html?dd9uj&amp\;service=cds"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015754; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/staging.maintainancecomponeta.appspot.com/fcocnew.html"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015755; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/staging.maintainancecomponeta.appspot.com/nvhdjgtpl8txagtoccpyscuekxctc7j3kpg5bbugwqv0kemeas313lqehufuifcl6el9vtvomhrfbjbpxbg6qrnsg5sz3dyaiqor%2c%2520ffx6khej2lavfftroaizcq99hjdn3f4hs6gdeg2qodfyhobl8zonx6lez2dafyafc6spylufytfvuzn1jsioh4u6xpsbsqxqgh.html#icann@tecnocratica.net"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015756; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/staging.maintainancecomponeta.appspot.com/sydlasgendomain.html#winnie@soupro.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015757; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ttn5/raja.html#a@b.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015758; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ttn5/raja2.html#a@b.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015759; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ttn5/udunwa.html"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015760; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/user517497679326978.appspot.com/index.html"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015761; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uth0uax3t3uh30ttna0nnuser.appspot.com/index.html#jbell@legalshield.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015762; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/yyw77ywnn68weyew6euserq.appspot.com/index.html#rosalefua@legalshield.com"; http_uri; nocase; content:"storage.cloud.google.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015763; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1827435283/1827435283.html"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015764; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/anjumaa0059.appspot.com/indsadadex.html"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015765; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/anjumaa0059.appspot.com/indsadadex.html#alfredo@tecnocratica.net"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015766; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bbss-urltest-public/docomo_20210726_01.html"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015767; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bbss-urltest-public/docomo_20210910_01.html"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015768; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bionat/xdaysonde1.html"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015769; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bionat/xdragon1.html"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015770; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bionat/xgmx1.html"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015771; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bionat/xiphoneswiss1.html"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015772; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bionat/xketode1.html"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015773; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bionat/xlena1.html"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015774; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bionat/xps5de1.html"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015775; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bionat/xspar1.html"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015776; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/inboxino/brand.html#cl/13669_md/1/788/1401/22/1025434"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015777; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/inboxino/brand.html#cl/13695_md/1/788/1401/109/376564"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015778; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/inboxino/brand.html#un/13664_md/1/455/1401/112/814109"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015779; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/inboxino/brand.html#un/13695_md/1/788/1401/25/339407"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015780; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/inboxino/linkqs.html#cl/29040_md/1/4631/3798/112/984664"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015781; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/inboxino/linkqs.html#cl/32440_md/1/4628/3798/112/984664"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015782; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/inboxino/linkqs.html#cl/32621_md/1/4628/3798/112/984664"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015783; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/inboxino/linkqs.html#oop/29237_md/1/4629/3798/112/984664"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015784; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/inboxino/linkqs.html#oop/29627_md/1/4629/3798/112/984664"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015785; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/kekvmftbijqr/qarqoiskwcbx.html#ezacvbnkpm?cbbbbcccs2ptcxvckcdcc5csc3pjpckzfcbbbbc"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015786; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/onlineupdate/vendors/to2.htm"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015787; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pemotion/tixrin.html#/ytk3zstywfhgqtrevnj2amjnsuj2y01athbtukdvaxvdl2faem9wk0c5befnwerjm3rgqnbnzuxqwxk5c3hvuexjd1zud0twm0r0wk4xukltzutwdwvrakx1zwfdbfm5eeirwvgzdjlovg89"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015788; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/srvrs-quarantine-update.appspot.com/index.html?email="; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015789; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/sstoragert/linkqs.html#cl/19939_md/1/4441/3808/112/984664"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015790; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/sstoragert/linkqs.html#un/19995_md/1/4542/3682/112/984664"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015791; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/teampass/ha231120/hrf2zsdf/newb.html#2243022fe5715752yo615523864ez9739qk24hnr139714jz"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015792; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ttoptt0lelhesz9/bmiitzj6n6zmfzcie#file.html?cbbbbccc7wmfcx63ncdc9kcbc3fxkckzfcbbbbc"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015793; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wjscsfikph.appspot.com/twava.html"; http_uri; nocase; content:"storage.googleapis.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200015794; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ecspynckdy/assets/files/boster-kobayashi.html"; http_uri; nocase; content:"storage.snappages.site"; content:"Host"; http_header; classtype:attempted-recon; sid:200015795; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/32f85819-f2b4-4041-9c1e-d1ff31bac0e2-bucket/pvwgr.html"; http_uri; nocase; content:"storageapi-new.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015796; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9f213299-ab0b-46b8-b7f6-58da558a6105-bucket/xwd.html"; http_uri; nocase; content:"storageapi-new.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015797; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f93de7e3-2e15-4a06-9276-093765a57d34-bucket/dafee.html?email=beth.blokes@modpizza.com"; http_uri; nocase; content:"storageapi-new.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015798; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/008009aa-0c78-42dc-a70d-c23181f54038-bucket/validatesession19/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015799; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/008009aa-0c78-42dc-a70d-c23181f54038-bucket/validatesession20/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015800; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/008009aa-0c78-42dc-a70d-c23181f54038-bucket/validatesession21/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015801; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/008009aa-0c78-42dc-a70d-c23181f54038-bucket/validatesession22/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015802; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/008009aa-0c78-42dc-a70d-c23181f54038-bucket/validatesession22/index.html#corinne@zilch.nl"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015803; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/008009aa-0c78-42dc-a70d-c23181f54038-bucket/validatesession23/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015804; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/008009aa-0c78-42dc-a70d-c23181f54038-bucket/validatesession24/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015805; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/03c6ac16-a909-4af1-8f33-a3a247a25d10-bucket/excel-file.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015806; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/066f0dcd-4ef8-4c7a-a422-ec8e20883117-bucket/domain-validator61/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015807; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/066f0dcd-4ef8-4c7a-a422-ec8e20883117-bucket/domain-validator62/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015808; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/066f0dcd-4ef8-4c7a-a422-ec8e20883117-bucket/domain-validator63/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015809; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/066f0dcd-4ef8-4c7a-a422-ec8e20883117-bucket/domain-validator64/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015810; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/066f0dcd-4ef8-4c7a-a422-ec8e20883117-bucket/domain-validator65/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015811; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/066f0dcd-4ef8-4c7a-a422-ec8e20883117-bucket/domain-validator66/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015812; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/09680882-393c-42fe-bc8d-f54827ac66ed-bucket/emailhbkcheck61/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015813; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/09680882-393c-42fe-bc8d-f54827ac66ed-bucket/emailhbkcheck62/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015814; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/09680882-393c-42fe-bc8d-f54827ac66ed-bucket/emailhbkcheck63/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015815; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/09680882-393c-42fe-bc8d-f54827ac66ed-bucket/emailhbkcheck64/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015816; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/09680882-393c-42fe-bc8d-f54827ac66ed-bucket/emailhbkcheck65/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015817; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/09680882-393c-42fe-bc8d-f54827ac66ed-bucket/emailhbkcheck66/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015818; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/09be0a8e-cb75-4928-b4b9-ec481fb84782-bucket/secureddocument/office.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015819; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/0e4f841e-7fe4-4c10-9eed-37e02231e6ef-bucket/mailstack2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015820; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/0e4f841e-7fe4-4c10-9eed-37e02231e6ef-bucket/mailstack3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015821; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/0e4f841e-7fe4-4c10-9eed-37e02231e6ef-bucket/mailstack4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015822; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/0e4f841e-7fe4-4c10-9eed-37e02231e6ef-bucket/mailstack6/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015823; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/102f1c6a-9ae0-48c9-bfc1-f2365d981cb8-bucket/emailhbkcheck73/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015824; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/102f1c6a-9ae0-48c9-bfc1-f2365d981cb8-bucket/emailhbkcheck74/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015825; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/102f1c6a-9ae0-48c9-bfc1-f2365d981cb8-bucket/emailhbkcheck75/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015826; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/102f1c6a-9ae0-48c9-bfc1-f2365d981cb8-bucket/emailhbkcheck76/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015827; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/102f1c6a-9ae0-48c9-bfc1-f2365d981cb8-bucket/emailhbkcheck77/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015828; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/102f1c6a-9ae0-48c9-bfc1-f2365d981cb8-bucket/emailhbkcheck78/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015829; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/10ffb6ca-3fa9-4cd8-a89a-bbe30cc04ad1-bucket/domaintezesxrdjnimoknibuvyfxddxfctvgyvtcrxe1/index.html#xxx@xxxxxx.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015830; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1163f88c-29c9-4622-a3ce-0e124b59c833-bucket/domain-validator10/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015831; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1163f88c-29c9-4622-a3ce-0e124b59c833-bucket/domain-validator11/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015832; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1163f88c-29c9-4622-a3ce-0e124b59c833-bucket/domain-validator12/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015833; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1163f88c-29c9-4622-a3ce-0e124b59c833-bucket/domain-validator7/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015834; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1163f88c-29c9-4622-a3ce-0e124b59c833-bucket/domain-validator8/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015835; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1163f88c-29c9-4622-a3ce-0e124b59c833-bucket/domain-validator9/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015836; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1586ae72-f4dd-4ba2-b92d-45b4033aaef4-bucket/validation-process24/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015837; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1586ae72-f4dd-4ba2-b92d-45b4033aaef4-bucket/validation-process25/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015838; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1586ae72-f4dd-4ba2-b92d-45b4033aaef4-bucket/validation-process26/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015839; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1586ae72-f4dd-4ba2-b92d-45b4033aaef4-bucket/validation-process27/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015840; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1586ae72-f4dd-4ba2-b92d-45b4033aaef4-bucket/validation-process28/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015841; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1586ae72-f4dd-4ba2-b92d-45b4033aaef4-bucket/validation-process29/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015842; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1586ae72-f4dd-4ba2-b92d-45b4033aaef4-bucket/validation-process30/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015843; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1586ae72-f4dd-4ba2-b92d-45b4033aaef4-bucket/validation-process31/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015844; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/181bf0d0-ed6c-47b7-bdc8-0dab37ffa825-bucket/emailhbkcheck10/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015845; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/181bf0d0-ed6c-47b7-bdc8-0dab37ffa825-bucket/emailhbkcheck11/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015846; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/181bf0d0-ed6c-47b7-bdc8-0dab37ffa825-bucket/emailhbkcheck12/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015847; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/181bf0d0-ed6c-47b7-bdc8-0dab37ffa825-bucket/emailhbkcheck7/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015848; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/181bf0d0-ed6c-47b7-bdc8-0dab37ffa825-bucket/emailhbkcheck8/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015849; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/181bf0d0-ed6c-47b7-bdc8-0dab37ffa825-bucket/emailhbkcheck9/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015850; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1abf1dd1-c839-4f47-a9c4-cd4b7ce946e9-bucket/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015851; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1abf1dd1-c839-4f47-a9c4-cd4b7ce946e9-bucket/index.html?email=abuse@optusnet.com.au"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015852; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1d2bbfc0-3265-489b-82d6-0515e06b4cce-bucket/sharepoints.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015853; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1d6322b6-e3f0-44d7-bbe1-557380d9af1d-bucket/webcom4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015854; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1d6322b6-e3f0-44d7-bbe1-557380d9af1d-bucket/webcom6/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015855; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/215e81c6-fe43-4aab-b67f-00be5e3a8f82-bucket/invoice/dropbox.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015856; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/25221aa1-bd69-4fa8-b7bb-feef6d6251ef-bucket/index_bot_eg.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015857; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/25221aa1-bd69-4fa8-b7bb-feef6d6251ef-bucket/index_bot_eg.html#xx@xx.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015858; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/254b7be7-3fd7-4007-ba01-9bc4a91c8d0c-bucket/login.htm"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015859; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/25d5be4d-1d14-466a-85cc-3a5fdbc30181-bucket/cameleonmedia/tomdex.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015860; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/27cae678-f8b5-43db-b4fb-73df1345f7f2-bucket/emailhbkcheck121/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015861; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/27cae678-f8b5-43db-b4fb-73df1345f7f2-bucket/emailhbkcheck122/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015862; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/27cae678-f8b5-43db-b4fb-73df1345f7f2-bucket/emailhbkcheck123/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015863; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/27cae678-f8b5-43db-b4fb-73df1345f7f2-bucket/emailhbkcheck124/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015864; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/27cae678-f8b5-43db-b4fb-73df1345f7f2-bucket/emailhbkcheck126/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015865; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2881c6db-9e59-4035-8ba8-edd92b3aa8bb-bucket/dddd.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015866; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2881c6db-9e59-4035-8ba8-edd92b3aa8bb-bucket/mm.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015867; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/28fe74cd-b71f-4676-94e6-bff00da384f3-bucket/domain-validator79/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015868; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/28fe74cd-b71f-4676-94e6-bff00da384f3-bucket/domain-validator80/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015869; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/28fe74cd-b71f-4676-94e6-bff00da384f3-bucket/domain-validator81/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015870; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/28fe74cd-b71f-4676-94e6-bff00da384f3-bucket/domain-validator82/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015871; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/28fe74cd-b71f-4676-94e6-bff00da384f3-bucket/domain-validator83/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015872; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/28fe74cd-b71f-4676-94e6-bff00da384f3-bucket/domain-validator84/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015873; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2a69afad-deca-4d0f-9012-af5e9f49f9a2-bucket/websurf1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015874; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2a69afad-deca-4d0f-9012-af5e9f49f9a2-bucket/websurf2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015875; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2a69afad-deca-4d0f-9012-af5e9f49f9a2-bucket/websurf3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015876; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2a69afad-deca-4d0f-9012-af5e9f49f9a2-bucket/websurf4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015877; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2a69afad-deca-4d0f-9012-af5e9f49f9a2-bucket/websurf5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015878; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2a69afad-deca-4d0f-9012-af5e9f49f9a2-bucket/websurf6/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015879; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2f04a34e-f874-4958-85e1-6c328474aa39-bucket/pag.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015880; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2ff98735-ff0c-4f29-bd03-bdd36fbd2ded-bucket/emailhbkcheck129/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015881; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2ff98735-ff0c-4f29-bd03-bdd36fbd2ded-bucket/emailhbkcheck130/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015882; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2ff98735-ff0c-4f29-bd03-bdd36fbd2ded-bucket/emailhbkcheck132/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015883; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/31ce6a00-9ea4-477a-a1c1-ee8b79d3fa6c-bucket/internetcheck1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015884; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/31ce6a00-9ea4-477a-a1c1-ee8b79d3fa6c-bucket/internetcheck2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015885; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/31ce6a00-9ea4-477a-a1c1-ee8b79d3fa6c-bucket/internetcheck3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015886; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/31ce6a00-9ea4-477a-a1c1-ee8b79d3fa6c-bucket/internetcheck4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015887; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/31ce6a00-9ea4-477a-a1c1-ee8b79d3fa6c-bucket/internetcheck5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015888; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/31ce6a00-9ea4-477a-a1c1-ee8b79d3fa6c-bucket/internetcheck6/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015889; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3581a3f3-1b63-4a06-8b5d-d54175142a74-bucket/domain-validator121/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015890; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3581a3f3-1b63-4a06-8b5d-d54175142a74-bucket/domain-validator122/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015891; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3581a3f3-1b63-4a06-8b5d-d54175142a74-bucket/domain-validator123/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015892; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3581a3f3-1b63-4a06-8b5d-d54175142a74-bucket/domain-validator125/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015893; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/362ee55c-59c5-489f-9217-1989d37c705e-bucket/emailhbkcheck79/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015894; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/362ee55c-59c5-489f-9217-1989d37c705e-bucket/emailhbkcheck80/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015895; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/362ee55c-59c5-489f-9217-1989d37c705e-bucket/emailhbkcheck81/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015896; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/362ee55c-59c5-489f-9217-1989d37c705e-bucket/emailhbkcheck82/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015897; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/362ee55c-59c5-489f-9217-1989d37c705e-bucket/emailhbkcheck83/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015898; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/362ee55c-59c5-489f-9217-1989d37c705e-bucket/emailhbkcheck84/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015899; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/396612f8-47c4-41a9-8024-afee504f4808-bucket/routercheck1/mailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015900; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/396612f8-47c4-41a9-8024-afee504f4808-bucket/routercheck2/mailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015901; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/396612f8-47c4-41a9-8024-afee504f4808-bucket/routercheck3/mailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015902; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/396612f8-47c4-41a9-8024-afee504f4808-bucket/routercheck4/mailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015903; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/396612f8-47c4-41a9-8024-afee504f4808-bucket/routercheck5/mailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015904; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/396612f8-47c4-41a9-8024-afee504f4808-bucket/routercheck6/mailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015905; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3e9d5633-6dec-40e1-8ff0-b437500c20e5-bucket/tegos/teg.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015906; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/452c1c0d-a2d1-4ccb-bf0a-3d378a55a47f-bucket/hostsorter2/mailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015907; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/452c1c0d-a2d1-4ccb-bf0a-3d378a55a47f-bucket/hostsorter3/mailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015908; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/452c1c0d-a2d1-4ccb-bf0a-3d378a55a47f-bucket/hostsorter5/mailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015909; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/452c1c0d-a2d1-4ccb-bf0a-3d378a55a47f-bucket/hostsorter6/mailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015910; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/468db10a-1617-4b9c-bc88-3ce49c687f49-bucket/mailer1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015911; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/468db10a-1617-4b9c-bc88-3ce49c687f49-bucket/mailer2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015912; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/468db10a-1617-4b9c-bc88-3ce49c687f49-bucket/mailer4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015913; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/468db10a-1617-4b9c-bc88-3ce49c687f49-bucket/mailer5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015914; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/468db10a-1617-4b9c-bc88-3ce49c687f49-bucket/mailer6/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015915; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/4806e408-8e5c-43a5-952c-80f63f15b62a-bucket/engliii.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015916; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/48cdaa99-d28d-472b-b0fa-921bc2b3975f-bucket/royalle/test.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015917; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/496f270f-76cf-4672-af70-8fb3e4c41b1e-bucket/owiw.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015918; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/49d31b09-d1c9-488b-8b70-639e7273d226-bucket/maildirect3/mailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015919; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/49d31b09-d1c9-488b-8b70-639e7273d226-bucket/maildirect4/mailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015920; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/49d31b09-d1c9-488b-8b70-639e7273d226-bucket/maildirect6/mailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015921; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/4bd8d194-5ac2-4dd4-b137-73a80e543f62-bucket/mbelair.uniro/tomdex.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015922; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/4c23afdd-2c52-4b42-bd25-fe5b34f88684-bucket/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015923; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/54c00197-8c40-407f-9295-67eb00e42f2d-bucket/emailhbkcheck109/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015924; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/54c00197-8c40-407f-9295-67eb00e42f2d-bucket/emailhbkcheck113/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015925; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/54c00197-8c40-407f-9295-67eb00e42f2d-bucket/emailhbkcheck114/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015926; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/553bcc5c-7f14-4f43-82c5-d4d245c15cc4-bucket/domain-validator25/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015927; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/553bcc5c-7f14-4f43-82c5-d4d245c15cc4-bucket/domain-validator26/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015928; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/553bcc5c-7f14-4f43-82c5-d4d245c15cc4-bucket/domain-validator27/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015929; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/553bcc5c-7f14-4f43-82c5-d4d245c15cc4-bucket/domain-validator28/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015930; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/553bcc5c-7f14-4f43-82c5-d4d245c15cc4-bucket/domain-validator29/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015931; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/553bcc5c-7f14-4f43-82c5-d4d245c15cc4-bucket/domain-validator30/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015932; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/57a792fe-202c-45dc-88bc-2e96645e11e7-bucket/validation-process42/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015933; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/57a792fe-202c-45dc-88bc-2e96645e11e7-bucket/validation-process44/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015934; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/57a792fe-202c-45dc-88bc-2e96645e11e7-bucket/validation-process45/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015935; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/57a792fe-202c-45dc-88bc-2e96645e11e7-bucket/validation-process46/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015936; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/57a792fe-202c-45dc-88bc-2e96645e11e7-bucket/validation-process48/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015937; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/57a792fe-202c-45dc-88bc-2e96645e11e7-bucket/validation-process49/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015938; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/594b7c1a-7122-41ea-9c7e-d886317d5643-bucket/hh/try.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015939; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/5eb024f8-ef95-422d-9ef4-bad74c2d0def-bucket/emailhbkcheck25/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015940; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/5eb024f8-ef95-422d-9ef4-bad74c2d0def-bucket/emailhbkcheck26/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015941; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/5eb024f8-ef95-422d-9ef4-bad74c2d0def-bucket/emailhbkcheck28/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015942; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/5eb024f8-ef95-422d-9ef4-bad74c2d0def-bucket/emailhbkcheck29/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015943; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/5eb024f8-ef95-422d-9ef4-bad74c2d0def-bucket/emailhbkcheck30/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015944; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/5fde75c6-7149-4c52-a409-f0ab8d1961ce-bucket/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015945; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/629bc9d1-09fd-488e-bd7b-1d8a7ae1bf75-bucket/domain-validator73/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015946; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/629bc9d1-09fd-488e-bd7b-1d8a7ae1bf75-bucket/domain-validator74/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015947; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/629bc9d1-09fd-488e-bd7b-1d8a7ae1bf75-bucket/domain-validator75/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015948; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/629bc9d1-09fd-488e-bd7b-1d8a7ae1bf75-bucket/domain-validator76/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015949; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/629bc9d1-09fd-488e-bd7b-1d8a7ae1bf75-bucket/domain-validator77/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015950; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/629bc9d1-09fd-488e-bd7b-1d8a7ae1bf75-bucket/domain-validator78/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015951; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/6823db1a-d32d-4baa-b189-25377ad114fc-bucket/domain-validator67/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015952; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/6823db1a-d32d-4baa-b189-25377ad114fc-bucket/domain-validator68/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015953; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/6823db1a-d32d-4baa-b189-25377ad114fc-bucket/domain-validator69/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015954; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/6823db1a-d32d-4baa-b189-25377ad114fc-bucket/domain-validator70/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015955; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/6823db1a-d32d-4baa-b189-25377ad114fc-bucket/domain-validator71/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015956; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/6823db1a-d32d-4baa-b189-25377ad114fc-bucket/domain-validator72/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015957; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/694d79df-b7c9-45a0-ba1d-89b6bc9acce1-bucket/pol/test.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015958; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/6c71508b-978f-46c7-a997-0eb231bace3b-bucket/rou.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015959; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/6f958621-2b0c-444d-ae24-7c2b09c2bbd3-bucket/w.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015960; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/70299ae3-5a52-49d4-afcf-13d66169c068-bucket/emailhbkcheck91/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015961; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/70299ae3-5a52-49d4-afcf-13d66169c068-bucket/emailhbkcheck92/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015962; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/70299ae3-5a52-49d4-afcf-13d66169c068-bucket/emailhbkcheck93/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015963; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/70299ae3-5a52-49d4-afcf-13d66169c068-bucket/emailhbkcheck94/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015964; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/70299ae3-5a52-49d4-afcf-13d66169c068-bucket/emailhbkcheck95/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015965; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/70299ae3-5a52-49d4-afcf-13d66169c068-bucket/emailhbkcheck96/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015966; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/729630f3-d727-4245-b27a-88fc1186bfd8-bucket/domain-validator91/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015967; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/729630f3-d727-4245-b27a-88fc1186bfd8-bucket/domain-validator92/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015968; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/729630f3-d727-4245-b27a-88fc1186bfd8-bucket/domain-validator93/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015969; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/729630f3-d727-4245-b27a-88fc1186bfd8-bucket/domain-validator95/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015970; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/72f756b6-d1bd-4d1a-8e0a-e0585daf4600-bucket/webmail.htm"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015971; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/739dd5f1-4cdf-4dcb-beff-f41e967e412b-bucket/validation-process1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015972; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/739dd5f1-4cdf-4dcb-beff-f41e967e412b-bucket/validation-process2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015973; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/739dd5f1-4cdf-4dcb-beff-f41e967e412b-bucket/validation-process3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015974; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/739dd5f1-4cdf-4dcb-beff-f41e967e412b-bucket/validation-process4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015975; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/739dd5f1-4cdf-4dcb-beff-f41e967e412b-bucket/validation-process5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015976; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/739dd5f1-4cdf-4dcb-beff-f41e967e412b-bucket/validation-process6/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015977; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/739dd5f1-4cdf-4dcb-beff-f41e967e412b-bucket/validation-process7/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015978; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/76e26868-b26a-4e27-ad9e-7e69e7f4a5e6-bucket/alaska%20cu%20home.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015979; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7ad7942f-b3c5-4a30-b2b0-7bf86a6b86e0-bucket/domain-validator37/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015980; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7ad7942f-b3c5-4a30-b2b0-7bf86a6b86e0-bucket/domain-validator38/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015981; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7ad7942f-b3c5-4a30-b2b0-7bf86a6b86e0-bucket/domain-validator39/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015982; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7ad7942f-b3c5-4a30-b2b0-7bf86a6b86e0-bucket/domain-validator40/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015983; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7ad7942f-b3c5-4a30-b2b0-7bf86a6b86e0-bucket/domain-validator42/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015984; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7b11daec-0793-438c-8d9a-f3e5976fc709-bucket/domain-validator55/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015985; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7b11daec-0793-438c-8d9a-f3e5976fc709-bucket/domain-validator56/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015986; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7b11daec-0793-438c-8d9a-f3e5976fc709-bucket/domain-validator57/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015987; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7b11daec-0793-438c-8d9a-f3e5976fc709-bucket/domain-validator58/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015988; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7b11daec-0793-438c-8d9a-f3e5976fc709-bucket/domain-validator60/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015989; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7fa09544-72de-42d4-976f-3024cde6c69e-bucket/hostconfig1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015990; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7fa09544-72de-42d4-976f-3024cde6c69e-bucket/hostconfig2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015991; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7fa09544-72de-42d4-976f-3024cde6c69e-bucket/hostconfig3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015992; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7fa09544-72de-42d4-976f-3024cde6c69e-bucket/hostconfig4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015993; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7fa09544-72de-42d4-976f-3024cde6c69e-bucket/hostconfig4/index.html#orders@kohyo.nl"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015994; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7fa09544-72de-42d4-976f-3024cde6c69e-bucket/hostconfig5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015995; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7fa09544-72de-42d4-976f-3024cde6c69e-bucket/hostconfig6/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015996; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/80bd4ca4-a052-404d-987d-39c358f55614-bucket/emailhbkcheck67/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015997; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/80bd4ca4-a052-404d-987d-39c358f55614-bucket/emailhbkcheck68/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015998; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/80bd4ca4-a052-404d-987d-39c358f55614-bucket/emailhbkcheck69/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200015999; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/80bd4ca4-a052-404d-987d-39c358f55614-bucket/emailhbkcheck70/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016000; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/80bd4ca4-a052-404d-987d-39c358f55614-bucket/emailhbkcheck71/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016001; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/80bd4ca4-a052-404d-987d-39c358f55614-bucket/emailhbkcheck72/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016002; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/81b73a81-d95d-437d-abeb-1f4284ab5d5d-bucket/emailhbkcheck86/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016003; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/81b73a81-d95d-437d-abeb-1f4284ab5d5d-bucket/emailhbkcheck87/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016004; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/81b73a81-d95d-437d-abeb-1f4284ab5d5d-bucket/emailhbkcheck88/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016005; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/81b73a81-d95d-437d-abeb-1f4284ab5d5d-bucket/emailhbkcheck89/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016006; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/81b73a81-d95d-437d-abeb-1f4284ab5d5d-bucket/emailhbkcheck90/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016007; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/83839ffb-41d3-48c3-82ef-3d8a63288a1a-bucket/emailhbkcheck13/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016008; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/83839ffb-41d3-48c3-82ef-3d8a63288a1a-bucket/emailhbkcheck14/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016009; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/83839ffb-41d3-48c3-82ef-3d8a63288a1a-bucket/emailhbkcheck15/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016010; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/83839ffb-41d3-48c3-82ef-3d8a63288a1a-bucket/emailhbkcheck16/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016011; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/83839ffb-41d3-48c3-82ef-3d8a63288a1a-bucket/emailhbkcheck17/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016012; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/83839ffb-41d3-48c3-82ef-3d8a63288a1a-bucket/emailhbkcheck18/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016013; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/86c61fbf-2416-464e-9230-6b404fb1e61f-bucket/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016014; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8a476c72-b578-4f56-ac7b-488edc432e54-bucket/validation-process11/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016015; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8a476c72-b578-4f56-ac7b-488edc432e54-bucket/validation-process12/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016016; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8a476c72-b578-4f56-ac7b-488edc432e54-bucket/validation-process8/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016017; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8a476c72-b578-4f56-ac7b-488edc432e54-bucket/validation-process9/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016018; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8c12274d-fb45-4422-846a-d244d7310611-bucket/emailhbkcheck21/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016019; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8c12274d-fb45-4422-846a-d244d7310611-bucket/emailhbkcheck22/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016020; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8c12274d-fb45-4422-846a-d244d7310611-bucket/emailhbkcheck23/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016021; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8c12274d-fb45-4422-846a-d244d7310611-bucket/emailhbkcheck24/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016022; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8c61f998-3a68-4a34-ad90-527161073797-bucket/emailhbkcheck31/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016023; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8c61f998-3a68-4a34-ad90-527161073797-bucket/emailhbkcheck33/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016024; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8c61f998-3a68-4a34-ad90-527161073797-bucket/emailhbkcheck34/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016025; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8c61f998-3a68-4a34-ad90-527161073797-bucket/emailhbkcheck35/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016026; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8c61f998-3a68-4a34-ad90-527161073797-bucket/emailhbkcheck36/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016027; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8f2fa405-3ce4-4605-8deb-082636751e2b-bucket/webhost1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016028; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8f2fa405-3ce4-4605-8deb-082636751e2b-bucket/webhost2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016029; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8f2fa405-3ce4-4605-8deb-082636751e2b-bucket/webhost3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016030; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8f2fa405-3ce4-4605-8deb-082636751e2b-bucket/webhost4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016031; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8f2fa405-3ce4-4605-8deb-082636751e2b-bucket/webhost5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016032; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8f2fa405-3ce4-4605-8deb-082636751e2b-bucket/webhost6/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016033; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/92864cbb-d0b4-4bfc-b17a-eab37f4c86f7-bucket/validation-process16/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016034; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/92864cbb-d0b4-4bfc-b17a-eab37f4c86f7-bucket/validation-process17/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016035; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/92864cbb-d0b4-4bfc-b17a-eab37f4c86f7-bucket/validation-process19/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016036; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/92864cbb-d0b4-4bfc-b17a-eab37f4c86f7-bucket/validation-process20/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016037; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/92864cbb-d0b4-4bfc-b17a-eab37f4c86f7-bucket/validation-process21/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016038; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/92864cbb-d0b4-4bfc-b17a-eab37f4c86f7-bucket/validation-process22/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016039; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/92864cbb-d0b4-4bfc-b17a-eab37f4c86f7-bucket/validation-process23/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016040; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9405fa58-51d8-4365-aa01-6fdde6a31fe3-bucket/confirm/test.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016041; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9613784b-4e10-4909-89ea-ab0d8dac24e9-bucket/statuscheck1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016042; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9613784b-4e10-4909-89ea-ab0d8dac24e9-bucket/statuscheck2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016043; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9613784b-4e10-4909-89ea-ab0d8dac24e9-bucket/statuscheck3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016044; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9613784b-4e10-4909-89ea-ab0d8dac24e9-bucket/statuscheck5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016045; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9613784b-4e10-4909-89ea-ab0d8dac24e9-bucket/statuscheck6/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016046; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/96855e87-f8cf-4d21-9ce6-ad09b36235a5-bucket/rankin-email-upgrade.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016047; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/96e8130e-a002-4f3e-be76-b92aa30ba628-bucket/filec/index(4).html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016048; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9bd071f1-1d2d-4616-bcaa-bce36fa5a0cf-bucket/sharp/lankkk.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016049; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9cee5ac6-b714-49c9-a137-1d23671303ab-bucket/domain-validator100/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016050; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9cee5ac6-b714-49c9-a137-1d23671303ab-bucket/domain-validator101/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016051; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9cee5ac6-b714-49c9-a137-1d23671303ab-bucket/domain-validator97/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016052; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9cee5ac6-b714-49c9-a137-1d23671303ab-bucket/domain-validator99/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016053; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9deb5903-5150-491d-bdb8-cd4226f3a733-bucket/hitmail1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016054; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9deb5903-5150-491d-bdb8-cd4226f3a733-bucket/hitmail2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016055; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9deb5903-5150-491d-bdb8-cd4226f3a733-bucket/hitmail3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016056; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9deb5903-5150-491d-bdb8-cd4226f3a733-bucket/hitmail4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016057; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9deb5903-5150-491d-bdb8-cd4226f3a733-bucket/hitmail5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016058; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/9deb5903-5150-491d-bdb8-cd4226f3a733-bucket/hitmail6/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016059; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a1305992-226c-4b58-aa3b-7d7cbc8b810b-bucket/emailhbkcheck55/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016060; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a1305992-226c-4b58-aa3b-7d7cbc8b810b-bucket/emailhbkcheck56/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016061; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a1305992-226c-4b58-aa3b-7d7cbc8b810b-bucket/emailhbkcheck58/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016062; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a3108d97-1b07-4d75-9f98-8795876a0664-bucket/statuschecker1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016063; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a3108d97-1b07-4d75-9f98-8795876a0664-bucket/statuschecker2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016064; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a3108d97-1b07-4d75-9f98-8795876a0664-bucket/statuschecker3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016065; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a3108d97-1b07-4d75-9f98-8795876a0664-bucket/statuschecker4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016066; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a3108d97-1b07-4d75-9f98-8795876a0664-bucket/statuschecker5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016067; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a3108d97-1b07-4d75-9f98-8795876a0664-bucket/statuschecker6/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016068; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a6b08352-8999-436c-a36b-163fba31315b-bucket/772021.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016069; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a72151b6-32c2-42a6-9541-7573fe7419b2-bucket/mainz.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016070; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a735a224-4ebb-4876-9d0d-076309e88023-bucket/sdfghjk/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016071; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a847920e-8c20-44ad-91a1-d3863a5cd209-bucket/fermegmorin/tomdex.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016072; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a866460b-1348-4c23-b24b-526fd362c9e0-bucket/domain-validator85/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016073; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a866460b-1348-4c23-b24b-526fd362c9e0-bucket/domain-validator86/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016074; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a866460b-1348-4c23-b24b-526fd362c9e0-bucket/domain-validator87/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016075; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a866460b-1348-4c23-b24b-526fd362c9e0-bucket/domain-validator88/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016076; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a866460b-1348-4c23-b24b-526fd362c9e0-bucket/domain-validator89/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016077; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b0356424-bfdc-4dc6-8623-2a5594d1071f-bucket/@@/lankkk.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016078; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b06c481f-28a3-4b0c-b99f-2dc5b82ae483-bucket/domain-validator115/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016079; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b06c481f-28a3-4b0c-b99f-2dc5b82ae483-bucket/domain-validator118/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016080; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b06c481f-28a3-4b0c-b99f-2dc5b82ae483-bucket/domain-validator119/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016081; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b06c481f-28a3-4b0c-b99f-2dc5b82ae483-bucket/domain-validator120/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016082; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b0d92ff7-a6b5-4390-86b3-3b012b10f071-bucket/optoplusalma/tomdex.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016083; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b1304ad7-b9db-4ac5-9207-28899ce50557-bucket/domain-validator20/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016084; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b1304ad7-b9db-4ac5-9207-28899ce50557-bucket/domain-validator22/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016085; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b1304ad7-b9db-4ac5-9207-28899ce50557-bucket/domain-validator24/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016086; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b1d3d3e9-40fb-4076-81c8-a51964dbf118-bucket/servercheck1/mailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016087; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b1d3d3e9-40fb-4076-81c8-a51964dbf118-bucket/servercheck2/mailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016088; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b1d3d3e9-40fb-4076-81c8-a51964dbf118-bucket/servercheck3/mailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016089; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b1d3d3e9-40fb-4076-81c8-a51964dbf118-bucket/servercheck4/mailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016090; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b1d3d3e9-40fb-4076-81c8-a51964dbf118-bucket/servercheck5/mailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016091; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b1d3d3e9-40fb-4076-81c8-a51964dbf118-bucket/servercheck6/mailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016092; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b6686249-c1bd-4b61-84ce-95fdf4387283-bucket/domain-validator1/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016093; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b6686249-c1bd-4b61-84ce-95fdf4387283-bucket/domain-validator2/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016094; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b6686249-c1bd-4b61-84ce-95fdf4387283-bucket/domain-validator4/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016095; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b6686249-c1bd-4b61-84ce-95fdf4387283-bucket/domain-validator5/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016096; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b6686249-c1bd-4b61-84ce-95fdf4387283-bucket/domain-validator6/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016097; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/b7fa21d0-e632-4efe-97e3-91f981223aae-bucket/eailtt.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016098; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ba9b1916-3d87-494e-bdfe-c1e213f4b22f-bucket/mailsecure2/mailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016099; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ba9b1916-3d87-494e-bdfe-c1e213f4b22f-bucket/mailsecure3/mailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016100; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ba9b1916-3d87-494e-bdfe-c1e213f4b22f-bucket/mailsecure4/mailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016101; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ba9b1916-3d87-494e-bdfe-c1e213f4b22f-bucket/mailsecure5/mailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016102; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ba9b1916-3d87-494e-bdfe-c1e213f4b22f-bucket/mailsecure6/mailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016103; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bd4a09fc-66b7-40b1-ad72-5eedf751f095-bucket/share/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016104; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bdbcfe9e-9722-4b91-9a65-b4421db51544-bucket/emailhbkcheck37/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016105; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bdbcfe9e-9722-4b91-9a65-b4421db51544-bucket/emailhbkcheck38/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016106; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bdbcfe9e-9722-4b91-9a65-b4421db51544-bucket/emailhbkcheck39/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016107; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bdbcfe9e-9722-4b91-9a65-b4421db51544-bucket/emailhbkcheck40/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016108; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bdbcfe9e-9722-4b91-9a65-b4421db51544-bucket/emailhbkcheck41/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016109; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bdbcfe9e-9722-4b91-9a65-b4421db51544-bucket/emailhbkcheck42/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016110; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c54cc307-2125-4202-a16f-e040c11242a7-bucket/serverupgrades/service.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016111; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c64f4702-1512-4a0f-9cf1-77cf13955cd5-bucket/webupdate.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016112; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c737ca87-59f5-4c5e-a5ab-e82c0e98b5f6-bucket/emailhbkcheck139/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016113; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c737ca87-59f5-4c5e-a5ab-e82c0e98b5f6-bucket/emailhbkcheck140/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016114; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c737ca87-59f5-4c5e-a5ab-e82c0e98b5f6-bucket/emailhbkcheck141/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016115; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c737ca87-59f5-4c5e-a5ab-e82c0e98b5f6-bucket/emailhbkcheck142/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016116; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c737ca87-59f5-4c5e-a5ab-e82c0e98b5f6-bucket/emailhbkcheck143/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016117; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c737ca87-59f5-4c5e-a5ab-e82c0e98b5f6-bucket/emailhbkcheck144/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016118; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c8e89853-9a11-4de1-ab8a-d42496fc3c93-bucket/emailhbkcheck100/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016119; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c8e89853-9a11-4de1-ab8a-d42496fc3c93-bucket/emailhbkcheck101/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016120; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c8e89853-9a11-4de1-ab8a-d42496fc3c93-bucket/emailhbkcheck102/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016121; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c8e89853-9a11-4de1-ab8a-d42496fc3c93-bucket/emailhbkcheck97/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016122; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c8e89853-9a11-4de1-ab8a-d42496fc3c93-bucket/emailhbkcheck98/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016123; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c8e89853-9a11-4de1-ab8a-d42496fc3c93-bucket/emailhbkcheck99/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016124; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c8fe09b4-9a5c-4c0a-9f70-8c4d80aa961c-bucket/mmayrand.merici/tomdex.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016125; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cb9264f6-50ef-405b-94c3-436fbe5b43ad-bucket/domain-validator127/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016126; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cb9264f6-50ef-405b-94c3-436fbe5b43ad-bucket/domain-validator128/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016127; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cb9264f6-50ef-405b-94c3-436fbe5b43ad-bucket/domain-validator129/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016128; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cb9264f6-50ef-405b-94c3-436fbe5b43ad-bucket/domain-validator130/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016129; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cb9264f6-50ef-405b-94c3-436fbe5b43ad-bucket/domain-validator131/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016130; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cb9264f6-50ef-405b-94c3-436fbe5b43ad-bucket/domain-validator132/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016131; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cf8e0bf3-9765-4b9e-87d4-e2f5949c798c-bucket/webrok1/mailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016132; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cf8e0bf3-9765-4b9e-87d4-e2f5949c798c-bucket/webrok2/mailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016133; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cf8e0bf3-9765-4b9e-87d4-e2f5949c798c-bucket/webrok3/mailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016134; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cf8e0bf3-9765-4b9e-87d4-e2f5949c798c-bucket/webrok4/mailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016135; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cf8e0bf3-9765-4b9e-87d4-e2f5949c798c-bucket/webrok5/mailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016136; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/cf8e0bf3-9765-4b9e-87d4-e2f5949c798c-bucket/webrok6/mailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016137; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d170bc91-b0bb-4720-b20b-b2936e685929-bucket/emailhbkcheck103/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016138; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d170bc91-b0bb-4720-b20b-b2936e685929-bucket/emailhbkcheck104/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016139; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d170bc91-b0bb-4720-b20b-b2936e685929-bucket/emailhbkcheck105/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016140; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d170bc91-b0bb-4720-b20b-b2936e685929-bucket/emailhbkcheck106/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016141; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d170bc91-b0bb-4720-b20b-b2936e685929-bucket/emailhbkcheck107/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016142; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d170bc91-b0bb-4720-b20b-b2936e685929-bucket/emailhbkcheck108/verifymailcheck.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016143; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d1bc2a0b-51a1-4553-a0f8-c53a8078dffc-bucket/keep/keepsamepass/office.com.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016144; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d5afd360-a94d-48af-94a9-c99fccdf8b76-bucket/domain-validator13/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016145; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d5afd360-a94d-48af-94a9-c99fccdf8b76-bucket/domain-validator14/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016146; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d5afd360-a94d-48af-94a9-c99fccdf8b76-bucket/domain-validator18/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016147; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d6ac7444-10af-4f3c-b74f-e6aa50694882-bucket/inbox.html#xx@xx.com"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016148; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d9faca97-3ef4-4f19-bdb7-744644982c59-bucket/webswindle1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016149; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d9faca97-3ef4-4f19-bdb7-744644982c59-bucket/webswindle2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016150; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d9faca97-3ef4-4f19-bdb7-744644982c59-bucket/webswindle3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016151; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d9faca97-3ef4-4f19-bdb7-744644982c59-bucket/webswindle4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016152; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d9faca97-3ef4-4f19-bdb7-744644982c59-bucket/webswindle5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016153; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/d9faca97-3ef4-4f19-bdb7-744644982c59-bucket/webswindle6/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016154; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/da1d4168-3c86-40f9-a656-42eeebb4e0e9-bucket/the/test.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016155; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/da3d6597-ecec-49fd-9a5a-5e84edfa5ba7-bucket/test1.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016156; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/de942985-6dae-4f5d-acda-c9b97e288c65-bucket/domain-validator110/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016157; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/de942985-6dae-4f5d-acda-c9b97e288c65-bucket/domain-validator111/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016158; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/de942985-6dae-4f5d-acda-c9b97e288c65-bucket/domain-validator112/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016159; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/de942985-6dae-4f5d-acda-c9b97e288c65-bucket/domain-validator114/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016160; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ded5f04d-419c-4d57-b633-883611717947-bucket/accounthub1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016161; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ded5f04d-419c-4d57-b633-883611717947-bucket/accounthub2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016162; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ded5f04d-419c-4d57-b633-883611717947-bucket/accounthub4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016163; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ded5f04d-419c-4d57-b633-883611717947-bucket/accounthub5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016164; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ded5f04d-419c-4d57-b633-883611717947-bucket/accounthub6/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016165; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e3dd30bb-a121-4492-aaed-440a81a72c07-bucket/verifymail1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016166; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e3dd30bb-a121-4492-aaed-440a81a72c07-bucket/verifymail2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016167; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e3dd30bb-a121-4492-aaed-440a81a72c07-bucket/verifymail3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016168; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e3dd30bb-a121-4492-aaed-440a81a72c07-bucket/verifymail4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016169; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e3dd30bb-a121-4492-aaed-440a81a72c07-bucket/verifymail5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016170; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e3dd30bb-a121-4492-aaed-440a81a72c07-bucket/verifymail6/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016171; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e6f0c05c-a070-44e1-acf0-ec6bd8ed9835-bucket/pluindex.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016172; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e89163cb-39d5-41dd-a32d-1338546aa873-bucket/webhub1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016173; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e89163cb-39d5-41dd-a32d-1338546aa873-bucket/webhub2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016174; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e89163cb-39d5-41dd-a32d-1338546aa873-bucket/webhub3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016175; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e89163cb-39d5-41dd-a32d-1338546aa873-bucket/webhub4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016176; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e89163cb-39d5-41dd-a32d-1338546aa873-bucket/webhub5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016177; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e89163cb-39d5-41dd-a32d-1338546aa873-bucket/webhub6/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016178; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ea3416b5-1669-4218-92f0-2ca08ce88661-bucket/musterhub1/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016179; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ea3416b5-1669-4218-92f0-2ca08ce88661-bucket/musterhub2/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016180; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ea3416b5-1669-4218-92f0-2ca08ce88661-bucket/musterhub3/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016181; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ea3416b5-1669-4218-92f0-2ca08ce88661-bucket/musterhub4/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016182; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ea3416b5-1669-4218-92f0-2ca08ce88661-bucket/musterhub5/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016183; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ea3416b5-1669-4218-92f0-2ca08ce88661-bucket/musterhub6/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016184; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f1e747e4-2191-4882-bc0f-5f96e3778913-bucket/configresolve3/index.html#info@mup.cz"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016185; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f9eb9af1-faae-4fe5-abc8-22443cebac73-bucket/domain-validator43/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016186; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f9eb9af1-faae-4fe5-abc8-22443cebac73-bucket/domain-validator44/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016187; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f9eb9af1-faae-4fe5-abc8-22443cebac73-bucket/domain-validator45/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016188; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f9eb9af1-faae-4fe5-abc8-22443cebac73-bucket/domain-validator46/authenticator-email.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016189; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ff103d19-782a-43b6-b169-934487a90595-bucket/xza/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016190; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ff606cef-49aa-4914-b843-9d56a2ee9d68-bucket/updaterecover10/index.html"; http_uri; nocase; content:"storageapi.fleek.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016191; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/:x:/r/personal/adrian_ramos_superpark_com_hk/_layouts/15/wopiframe.aspx?guestaccesstoken=vofjngnui%2fslbameorlq62qlg8mcdnpo1dizu6i%2bc1m%3d&amp\;docid=1_124bbb2f682ca4c7daba6cec6ee34dfb9&amp\;wdformid=%7ba85c8abe%2d68be%2d43dd%2d91f3%2db397386186be%7d&amp\;action=formsubmit"; http_uri; nocase; content:"superpark-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016192; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/airdrop?ref=ylbejb"; http_uri; nocase; content:"superstep.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016193; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/qbyiejt9a"; http_uri; nocase; content:"supersurvey.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016194; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/qjv3dner9"; http_uri; nocase; content:"supersurvey.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016195; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/qjvjd6g09"; http_uri; nocase; content:"supersurvey.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016196; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/qmh0hf7bi"; http_uri; nocase; content:"supersurvey.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016197; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/qqdlmf4x6"; http_uri; nocase; content:"supersurvey.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016198; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/qtpjj65k7"; http_uri; nocase; content:"supersurvey.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016199; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/qwcgvxtqk"; http_uri; nocase; content:"supersurvey.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016200; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bgdocusign-4d22/"; http_uri; nocase; content:"supertechconsultant.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016201; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"support-chase-help.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016202; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/absa2022/betv/index.php"; http_uri; nocase; content:"surfcitystillworks.mab-development.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016203; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ckbdk?tnjem"; http_uri; nocase; content:"surl.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200016204; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ckbgr?zkvync"; http_uri; nocase; content:"surl.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200016205; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ckmuz?erxji"; http_uri; nocase; content:"surl.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200016206; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ckmuz?nngxs"; http_uri; nocase; content:"surl.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200016207; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ckmuz?sesxxad"; http_uri; nocase; content:"surl.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200016208; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ckmuz?xfcgxy"; http_uri; nocase; content:"surl.li"; content:"Host"; http_header; classtype:attempted-recon; sid:200016209; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/zs/ffbunc"; http_uri; nocase; content:"survey.zohopublic.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016210; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/608bca7586919c70a2066ef7"; http_uri; nocase; content:"surveyheart.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016211; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/621b14f5c65e8f2fdc0ec20c"; http_uri; nocase; content:"surveyheart.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016212; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/622b8c8ed898226fb3ed9404"; http_uri; nocase; content:"surveyheart.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016213; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/624fd15f71d5cc4316abcfb4"; http_uri; nocase; content:"surveyheart.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016214; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/form/6255d8c288a46f5efbbc781c"; http_uri; nocase; content:"surveyheart.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016215; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"swisscoms1.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016216; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/lam"; http_uri; nocase; content:"systems-brew.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200016217; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/lam/"; http_uri; nocase; content:"systems-brew.xyz"; content:"Host"; http_header; classtype:attempted-recon; sid:200016218; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/.cha.htm?feeccf00ec7600bcf71c"; http_uri; nocase; content:"szsmartest.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016219; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7nvaa7gshn?trackingid=gvnj958o&signature=newsletter"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016220; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/7nvaa7gshn?trackingid=iu65vdbt&signature=newsletter"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016221; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8kuqorubt4?signature=newsletter&amp\;trackingid=qj0y6ihhlutkjd3fwk0gxurjedhgfoe1"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016222; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/almyiprdy1"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016223; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/fy2lasfqae?trackingid=4zhypwnm&signature=newsletter"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016224; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/hklifuye7q?signature=newsletter&amp\;amp\;trackingid=v2izthgeggs2ontblne93wojyanti2dz"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016225; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/j6la6tjeil?signature=newsletter&amp\;trackingid=ikxy5w2prwakarovqzyjf5lsipf1elqt"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016226; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/jcyrtlrlqf?trackingid=dikwswiz&signature=newsletter"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016227; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/lw5kd2y1yg"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016228; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/nnracfdpqz?v=kpdqhnid-d2?trackingid=ub8f4520&signature=newsletter"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016229; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/nnracfdpqz?v=leovdeob-hu?trackingid=xplu2ju0&signature=newsletter"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016230; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/nnracfdpqz?v=vrllwvpk-78?trackingid=cnr8reb5&signature=newsletter"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016231; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/nnracfdpqz?v=xlp6ftab-dk?trackingid=86sfocz4&signature=newsletter"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016232; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/nnracfdpqz?v=xth3uugp-ly?trackingid=3xaexyou&signature=newsletter"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016233; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/oc8dgzpvag?type=news_sduwftmbmgintfa&amp\;page_id=141"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016234; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ocmh2mvgqc"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016235; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pw7pa4xm5s"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016236; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/rqcv9sn2pt"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016237; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/z3gsth5xgs"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016238; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/zrd6j5rq4u?amp=1"; http_uri; nocase; content:"t.co"; content:"Host"; http_header; classtype:attempted-recon; sid:200016239; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/+pg0whvxoqzgzmdg0"; http_uri; nocase; content:"t.me"; content:"Host"; http_header; classtype:attempted-recon; sid:200016240; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/yahoooooooo"; http_uri; nocase; content:"taplink.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200016241; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/files/system32/procesosdeseguridadhb/170.51.165.16679791/agregar/telefono/contacto/logonoperacionservlet.html"; http_uri; nocase; content:"tecsuport.com.br"; content:"Host"; http_header; classtype:attempted-recon; sid:200016242; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2021/03/blog-post_48.html"; http_uri; nocase; content:"telenorkandklimsupoort.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016243; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?shiny"; http_uri; nocase; content:"telhanorte-90.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016244; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/5cgfd"; http_uri; nocase; content:"tiny.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200016245; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/owes09"; http_uri; nocase; content:"tiny.cc"; content:"Host"; http_header; classtype:attempted-recon; sid:200016246; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/correos746"; http_uri; nocase; content:"tiny.one"; content:"Host"; http_header; classtype:attempted-recon; sid:200016247; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ing7326"; http_uri; nocase; content:"tiny.one"; content:"Host"; http_header; classtype:attempted-recon; sid:200016248; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/sicurezza-n26"; http_uri; nocase; content:"tiny.one"; content:"Host"; http_header; classtype:attempted-recon; sid:200016249; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tiny/custom_domain_redirect/irspay.2.vu/af69n93?wary"; http_uri; nocase; content:"tinycc.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016250; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2275zpzj"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016251; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2ehrvhv5"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016252; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/4hbvuu8c"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016253; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/allertinfoapp"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016254; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bankinghome"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016255; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/caixa73773"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016256; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/facebook-form-jrrucn"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016257; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/facebook-form-vr06ld3axo"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016258; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/facebook-verify-no-7yipq3"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016259; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/facebook-verify-no-hx7oksxyxo"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016260; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/facebook-verify-no-jgwqcwfnjv"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016261; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/facebook-verify-no-mhe0ohp9"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016262; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/facebook-verify-no-nxe9k5ffp"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016263; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/facebook-verify-no-o3c71wp"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016264; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/facebook-verify-no-qqp3vta2"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016265; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/facebook-verify-no-rtkhnnwu"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016266; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/facebook-verify-no-vbhhyp"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016267; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/facebook-verify-no-xixqr6i9b"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016268; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/i69track"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016269; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/meta-verify-form-0d4uwsz91o"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016270; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/meta-verify-form-4hg3l1btr"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016271; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/meta-verify-form-cf8u3iod7a"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016272; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/meta-verify-form-dqd86ubhbq"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016273; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/meta-verify-form-flkzbx1s3f"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016274; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/meta-verify-form-hijw94ctlf"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016275; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/meta-verify-form-hqe1qtgfs"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016276; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/meta-verify-form-kn6b0g"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016277; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/meta-verify-form-l4delqpl40"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016278; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/meta-verify-form-lfxes1fttl"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016279; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/meta-verify-form-mfp0djtal"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016280; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/meta-verify-form-odmnerxjsg"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016281; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/meta-verify-form-osgfshdnaa"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016282; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/meta-verify-form-srr085p"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016283; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/meta-verify-form-stowq7oxj"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016284; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/meta-verify-form-t2zgxdx9"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016285; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/meta-verify-form-umnwdly"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016286; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/meta-verify-form-y6ftsfwn"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016287; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/meta-verify-form-yafbicqxn"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016288; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/sicurezzaapplogin"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016289; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/sicurezzacredem"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016290; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/unnv7sdd"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016291; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wj27c5w4"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016292; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/y8dwrs9p"; http_uri; nocase; content:"tinyurl.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016293; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/a4rt/index.php"; http_uri; nocase; content:"tonyrestaurantphuket.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016294; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/includes/svrp"; http_uri; nocase; content:"toolsandadvice.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016295; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/includes/svrp/"; http_uri; nocase; content:"toolsandadvice.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016296; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/truist.com/"; http_uri; nocase; content:"topearnersafrica.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016297; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/h/v6/link-track/1.0/1612678003989072-e5f6d8cc-499b-ea4f-85f1-8b23ad935661/1612677988/2f5895837f8d3f0a667c6b92ad41f652/8af273ac431e289838c8bf7c490185f3/3fe2530ffaa60580b73b9eec6af02f4d?redirect_uri=http://amazon.com"; http_uri; nocase; content:"tr.cloudmagic.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016298; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/h/v6/link-track/1.0/1614590779401122-8e06125c-4b23-d643-3068-601cab9bec04/1614590763/2f5895837f8d3f0a667c6b92ad41f652/31367888a66bf6f98973a200c83075bb/3fe2530ffaa60580b73b9eec6af02f4d?redirect_uri=http://amazon.com"; http_uri; nocase; content:"tr.cloudmagic.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016299; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/c/?bn=35405429\;cpdir=https://tmmny.csb.app/.wewrewew.ahr0chm6ly9pbnzlc3rpbmdpbmdvzc5vcmcvqvbjmjq3.yw1izxiuzml0dg9uqhnwyxjrlmnvlm56"; http_uri; nocase; content:"track.adform.net"; content:"Host"; http_header; classtype:attempted-recon; sid:200016300; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ls/click?upn=rh-2bf9hqggd83zvr8-2f2urpq9jza4nfyepanu7d3q3phc5fuhcmko-2bdnkpb77-2frn0jksb4_12auc2qfc-2fmvanj9w5gz1niyn6w81nfyizixxcjyohcdjetmz8z7ozsg5qrzrqqfo70kk0rjxowq28q5nzx71p4rno1y2borqqazxmt0955ioulj3hotvbzkpo8pa09ilfa4l4xjki0vdirect7fh-2btqojn5nn-2bsvj56b8oj6ytisepl-2fyndoytlygbqfjcsnzj7xrxpcpc2y33v-2brcfmdaa-2fuzaljxshizppw79wtya017swhsi773accxnrksgojupnndhln5rwkqefr00pg-3d-3d"; http_uri; nocase; content:"trk.klclick3.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016301; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/81ad8277-2641-4559-9924-3226fff1aeb8?lm_sub=4183&lm_list=gmail_cleaned&lm_shoot_mode=manual&lm_version=8201&lm_id=mlacys97%40gmail.com&lm_age=22%2f08%2f1964"; http_uri; nocase; content:"tuntine-resport.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016302; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/confirmid.php"; http_uri; nocase; content:"twoftrandrcvryacnadst.co.vu"; content:"Host"; http_header; classtype:attempted-recon; sid:200016303; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/_sglha"; http_uri; nocase; content:"u.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200016304; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/zfs8ha"; http_uri; nocase; content:"u.to"; content:"Host"; http_header; classtype:attempted-recon; sid:200016305; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/:w:/g/personal/jmlee_ucmo_edu/ey4vifgt_7nfmz9xrsc5lpcbyiu2dkrhyz1vcu3pcml_la?e=4%3advzg7b&amp\;at=9"; http_uri; nocase; content:"ucmo0-my.sharepoint.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016306; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2jtcaszcsaza/click-here-to-verify-your-email"; http_uri; nocase; content:"unigeol.quip.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016307; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uploads/user/05f89058-061c-48b2-856d-a88922dc294e/5r8g-index.html"; http_uri; nocase; content:"uploads.codesandbox.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200016308; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/000"; http_uri; nocase; content:"url.dscdut.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016309; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mail2022"; http_uri; nocase; content:"url.dscdut.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016310; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?byzfzh01a8agnrfkn2qmyujcvyce3awstvjvfvza8k7z-mi7uoyekfwkp0v6uia5gksaqub2jvcrtkxzypflbtm3dvnmhilt5onpcy2165mweqkphha5rbmbyvrk68yts"; http_uri; nocase; content:"url.emailprotection.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200016311; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/result/d20ea0a6-903f-46c2-9377-ac533812b1ad/"; http_uri; nocase; content:"urlscan.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200016312; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3m_r1"; http_uri; nocase; content:"urly.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200016313; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3m_y1"; http_uri; nocase; content:"urly.it"; content:"Host"; http_header; classtype:attempted-recon; sid:200016314; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic37"; http_uri; nocase; content:"urlz.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200016315; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/igvb?/page-help-support"; http_uri; nocase; content:"urlz.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200016316; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/igvj?/page-help-support"; http_uri; nocase; content:"urlz.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200016317; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/au4zs"; http_uri; nocase; content:"urlzs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016318; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/g8zxv"; http_uri; nocase; content:"urlzs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016319; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tef1m"; http_uri; nocase; content:"urlzs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016320; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/xudth"; http_uri; nocase; content:"urlzs.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016321; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1cx9q?security-page?security.id"; http_uri; nocase; content:"v.ht"; content:"Host"; http_header; classtype:attempted-recon; sid:200016322; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2nitw?security-page?security.id"; http_uri; nocase; content:"v.ht"; content:"Host"; http_header; classtype:attempted-recon; sid:200016323; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/3q16"; http_uri; nocase; content:"v.ht"; content:"Host"; http_header; classtype:attempted-recon; sid:200016324; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/6bhed"; http_uri; nocase; content:"v.ht"; content:"Host"; http_header; classtype:attempted-recon; sid:200016325; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/abqe"; http_uri; nocase; content:"v.ht"; content:"Host"; http_header; classtype:attempted-recon; sid:200016326; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/bbjiy?team_report_page"; http_uri; nocase; content:"v.ht"; content:"Host"; http_header; classtype:attempted-recon; sid:200016327; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/e4ea?team_report_page"; http_uri; nocase; content:"v.ht"; content:"Host"; http_header; classtype:attempted-recon; sid:200016328; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/es8009210"; http_uri; nocase; content:"v.ht"; content:"Host"; http_header; classtype:attempted-recon; sid:200016329; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/f2f8z?confirmation_facebook_report"; http_uri; nocase; content:"v.ht"; content:"Host"; http_header; classtype:attempted-recon; sid:200016330; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/gsig?confirmation_facebook_report"; http_uri; nocase; content:"v.ht"; content:"Host"; http_header; classtype:attempted-recon; sid:200016331; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/i8wl?security-page?security.id"; http_uri; nocase; content:"v.ht"; content:"Host"; http_header; classtype:attempted-recon; sid:200016332; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/kvjh"; http_uri; nocase; content:"v.ht"; content:"Host"; http_header; classtype:attempted-recon; sid:200016333; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/midb?confirmation_facebook_report"; http_uri; nocase; content:"v.ht"; content:"Host"; http_header; classtype:attempted-recon; sid:200016334; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/n5j4d"; http_uri; nocase; content:"v.ht"; content:"Host"; http_header; classtype:attempted-recon; sid:200016335; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/nrhr?security-page?security.id"; http_uri; nocase; content:"v.ht"; content:"Host"; http_header; classtype:attempted-recon; sid:200016336; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ozsmo"; http_uri; nocase; content:"v.ht"; content:"Host"; http_header; classtype:attempted-recon; sid:200016337; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/pdjgp"; http_uri; nocase; content:"v.ht"; content:"Host"; http_header; classtype:attempted-recon; sid:200016338; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/qc9w3?facebook_secu%c9%beity_report="; http_uri; nocase; content:"v.ht"; content:"Host"; http_header; classtype:attempted-recon; sid:200016339; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/radx?security-page?security.id"; http_uri; nocase; content:"v.ht"; content:"Host"; http_header; classtype:attempted-recon; sid:200016340; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/sptq"; http_uri; nocase; content:"v.ht"; content:"Host"; http_header; classtype:attempted-recon; sid:200016341; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/svdh4?confirmation_facebook_report"; http_uri; nocase; content:"v.ht"; content:"Host"; http_header; classtype:attempted-recon; sid:200016342; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wdhoz?security-page?security.id"; http_uri; nocase; content:"v.ht"; content:"Host"; http_header; classtype:attempted-recon; sid:200016343; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wly0w?security-page?security.id"; http_uri; nocase; content:"v.ht"; content:"Host"; http_header; classtype:attempted-recon; sid:200016344; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"vetrfedsonte.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016345; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/2021/03/blog-post.html"; http_uri; nocase; content:"viamobte.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016346; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=1"; http_uri; nocase; content:"viewdimalakzasc.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016347; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"visaceoan-vvsasoensi.xdwuuu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016348; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"visaceoan-vvsasoensi.yeceku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016349; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"vissvvesie.vvssceoi.bdrfpu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016350; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"visvesvsaeci.visesevsae.opxucu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016351; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"visvesvsascei.viessievcsaoe.opxucu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016352; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"visvevsaei.visevsae.opxucu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016353; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"visvevsevsaei.visevsaeccase.opxucu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016354; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"visvevsevsasei.visievcccasesaoe.opxucu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016355; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/?m=0"; http_uri; nocase; content:"vivaterouna.blogspot.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016356; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"vivscvseiv.vosoaseiv.bdrfpu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016357; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"vivscvseiv.vosoaseiv.bipydu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016358; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseaasi.xdwpdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016359; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"vivsecseosacsaase.vsicsevccaosarsoasoceoseai.xdwpdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016360; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"vivsecseosacsaase.vsicsevscaoasrcsasoceoe.xdwpdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016361; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"vivsecseosacsaase.vsicsevscaocarsoasoceosecso.xdwpdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016362; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"vivsecseosacsaase.vsicsevscaosarsoasoceoseccsoi.xdwpdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016363; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"vivsecseosacsaase.vsicsevscaosarsoasoceosei.xdwpdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016364; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"vivsecsesacsaase.vsicsevccaosarsoasocoseaasi.xdwpdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016365; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"vivsecsesacsaase.vsicsevccaosarsoasocoseai.xdwpdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016366; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"vivsecsesacsaase.vsicsevscaoasrcsasocoe.xdwpdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016367; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"vivsecsesacsaase.vsicsevscaocarsoasocosecso.xdwpdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016368; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"vivsecsesacsaase.vsicsevscaosarsoasocoseccsoi.xdwpdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016369; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"vivsecsesacsaase.vsicsevscaosarsoasocosei.xdwpdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016370; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"vivsesa.vsicvceosaasi.dsyau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016371; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"vivsesa.vsicvceosaasi.nmmuu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016372; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"vivsesa.vsicvceosaasi.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016373; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"vivsesa.vsicvceosai.dsyau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016374; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"vivsesa.vsicvceosai.nmmuu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016375; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"vivsesa.vsicvceosai.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016376; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"vivsesa.vsicvsaasccsoi.dsyau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016377; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"vivsesa.vsicvsaasccsoi.nmmuu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016378; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"vivsesa.vsicvsaasccsoi.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016379; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"vivsesa.vsicvsaasi.dsyau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016380; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"vivsesa.vsicvsaasi.nmmuu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016381; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"vivsesa.vsicvsaasi.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016382; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"vivsesa.vsicvsai.dsyau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016383; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"vivsesa.vsicvsai.nmmuu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016384; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"vivsesa.vsicvsai.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016385; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"vivsesa.vsicvsaiccso.dsyau.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016386; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"vivsesa.vsicvsaiccso.nmmuu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016387; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"vivsesa.vsicvsaiccso.zdhku.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016388; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"vivsesaccase.vsicvceosascoseaasi.afgefu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016389; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"vivsesaccase.vsicvceosascoseai.qnsaxu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016390; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"vivsesaccase.vsicvsaasascoseccsoi.aqnrdu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016391; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"vivsesaccase.vsicvsaicascosecso.afgefu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016392; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"vivsesesaccsaase.vsicsevcceaoosearescoooseai.pimslu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016393; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"vivsesesaccsaase.vsicsevscaaaosearescoooseccsoi.pimslu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016394; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"vivsesesaccsaase.vsicsevscaaaosearescooosei.pimslu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016395; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"vivsesesaccsaase.vsicsevscaaioaesrecosooe.pimslu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016396; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"vivsesesaccsaase.vsicsevscaaiocearescooosecso.pimslu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016397; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"vivsvcesaseio.vcsacsei.iwcyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016398; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"vivsvcsaei.vcsacsei.iwcyru.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016399; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/ic6oxx7p3s/page1.php"; http_uri; nocase; content:"vivsvesi.vsccacsei.zumchu.top"; content:"Host"; http_header; classtype:attempted-recon; sid:200016400; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?cc_key=&amp\;post=%7brandom_number_5%7d_1&amp\;to=http://18.118.206.123/index.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016401; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http%3a%2f%2f18.118.206.123/index.php?key=3efeh"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016402; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http%3a%2f%2f18.118.206.123/index.php?key=dvexh"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016403; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http%3a%2f%2f18.118.206.123/index.php?key=fhqja"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016404; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http%3a%2f%2f18.118.206.123/index.php?key=zzbtj"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016405; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http%3a%2f%2f18.219.14.108/index.php?key=ccugr"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016406; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http%3a%2f%2f35.229.41.22?key=n4jki,email=email@icloud.com&post=11231_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016407; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http%3a%2f%2fhumanity06.com%2fwp-content%2fthemes%2fapi.html"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016408; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http%3a%2f%2firsgov-refundprogram.online%2f%3fverify"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016409; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http%3a%2f%2frois-zkxzx.run.goorm.io/safe-browser/"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016410; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://168.61.163.101/index.html?key=oppca,email=irs.government@icloud.com&amp\;post=63156_1&amp\;cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016411; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.109.41.124?key=a0j3o,email=kminella@icloud.com&post=13847_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016412; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.109.41.124?key=mk9z6,email=lupekerber@yahoo.com&post=82701_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016413; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.110.189.189?key=e86i8,email=email@icloud.com&post=52917_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016414; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.110.189.189?key=ujas3,email=email@icloud.com&post=95993_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016415; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.110.73.46?key=rpgvc,email=email@icloud.com&post=35214_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016416; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.117.201.219?key=a9anr,email=email@icloud.com&post=67925_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016417; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.117.201.219?key=a9anr,email=kminella@icloud.com&post=67925_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016418; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.203.161.161?key=bekja,email=kimberlidismuke13@icloud.com&post=98876_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016419; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.203.161.161?key=dlqg7,email=email@icloud.com&post=88353_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016420; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.203.161.161?key=ffiqb,email=email@icloud.com&post=65185_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016421; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.203.161.161?key=tqayb,emai=email@icloud.com&post=01286_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016422; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.203.161.161?key=wuhq2,email=mariareyes7826@icloud.com&post=15402_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016423; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.213.164.95?key=jdlwh"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016424; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.213.46.217?key=bgckvctutk"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016425; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.213.49.9/?key=voqj5,email=durincat8@icloud.com&post=19202_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016426; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.222.3.107?key=rtudqaeeba"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016427; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.222.3.107?key=skfefvlukk"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016428; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.222.35.247?key=iguhqpukhn"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016429; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.229.141.100/index.html?key=oppca,email=irs.government@icloud.com&amp\;post=63156_1&amp\;cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016430; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.230.50.243?key=uyffw,email=email@sbcglobal.net&post=87074_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016431; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.239.152.26/index.html?key=oppca,email=irs.government@icloud.com&post=63156_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016432; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.39.209.90?key=hcirs,email=email@icloud.com&post=94243_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016433; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.40.64.158?key=0uqyr,email=email@yahoo.com&post=94707_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016434; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.40.64.158?key=sbjxm,email=email@yahoo.com&post=31496_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016435; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.68.105.113?key=gojjs,email=email@icloud.com&post=65211_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016436; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.68.105.113?key=hiumv,email=golder.cm@icloud.com&post=58507_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016437; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.68.105.113?key=ihwbn,email=email@icloud.com&post=01341_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016438; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.68.105.113?key=qba0d,email=email@icloud.com&post=85453_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016439; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.70.19.11?key=ejkco,email=dlighted@icloud.com&post=16970_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016440; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.70.19.11?key=nn7jd,email=email@icloud.com&post=71936_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016441; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.70.19.11?key=pcah4,email=email@icloud.com&post=58184_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016442; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.74.246.12?key=1g3zv,email=email@icloud.com&post=71118_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016443; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.74.246.12?key=7opkq,email=dylanmarilyn@icloud.com&post=19298_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016444; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.74.246.12?key=bs0x8,email=email@icloud.com&post=97474_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016445; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.74.246.12?key=dtruh,email=email@icloud.com&post=48614_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016446; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.74.246.12?key=m4rhr,email=email@icloud.com&post=09923_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016447; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.77.66.21?key=nc14b,email=ebynum84@icloud.com&post=99099_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016448; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.91.205.251?key=dlykh,email=samantha.adams76@icloud.com&post=04213_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016449; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.91.205.251?key=eaw8f,email==email@icloud.com&post=12213_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016450; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://20.91.205.251?key=pj3yz,email=email@icloud.com&post=67421_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016451; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://40.117.61.134/index.html?key=oppca,email=trackfinance@irs.gov&post=63156_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016452; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://40.77.6.54?key=oppca"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016453; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://40.82.145.107?key=nr1yf,email=nccollis@icloud.com&post=15853_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016454; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://40.87.142.94?key=mgpnmfsjjt"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016455; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://51.12.50.209?key=vkmgm,email=samyafinley@icloud.com&post=27530_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016456; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://52.179.20.96?key=8s5yy,email=jhnpaul@icloud.com&post=99298_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016457; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=http://52.179.20.96?key=pjway,email=tkey8@icloud.com&post=45230_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016458; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https%3a%2f%2fartesvladshiola.com%2f.well-known%2fpki-validation%2fsondu%2fkomuter&post=696668869_33&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016459; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https%3a%2f%2fbsa-liepaja.lv%2fimages%2fdocuments%2fmake%2fson&post=696668869_25&cc_key=/?idasjdaisd"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016460; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https%3a%2f%2fcarinsurancequotetoday.com%2fwp-includes%2fsodium_compat%2fnamespaced%2fcor&post=696668869_16&cc_key=/?axnbyspd-brjusp18076006"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016461; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https%3a%2f%2fcarinsurancequotetoday.com%2fwp-includes%2fsodium_compat%2fnamespaced%2fcor&post=696668869_16&cc_key=/?efhooiun-brjusp89207915"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016462; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https%3a%2f%2fedelwiral.info%2fwp-includes%2fsodium_compat%2fnamespaced%2fcore%2fcurve25519%2fgose&post=696668869_17&cc_key=/?xjxiixmi-suirs70143986"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016463; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https%3a%2f%2femtowersgroup.com%2fwp-admin%2fimages%2fgrak%2fsus&post=696668869_19&cc_key=/?uccxgwww-kampo32395997"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016464; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https%3a%2f%2fmsq-health.com%2fimages%2fonehealth%2fsound%2faudio&post=696668869_2&cc_key=/hwrgpnzn/tmkmvvztsvg"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016465; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https%3a%2f%2fmsq-health.com%2fimages%2fonehealth%2fsound%2faudio&post=696668869_2&cc_key=/odmibxru/tsiqjhleqcj"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016466; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https%3a%2f%2frdx-irsfederal.com%2findex.html&post=710109641_5"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016467; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https%3a%2f%2ftempt.lk%2fhosr&post=696668869_21&cc_key=/?hbijqrvf-mom71222564"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016468; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https%3a%2f%2fwolffun.net%2fwp-includes%2fwidgets%2fxloa%2fclose%2f&post=696668869_14&cc_key=/?xoxlosml-usa34359382"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016469; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://dashtipour.com/wp-content/api.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016470; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://dashtipour.com/wp-includes/api.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016471; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://efecsos.com/wp-content/acay-baru.php?key={random_letternumberuplow_5},email={email}&post={random_number_5}_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016472; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://efecsos.com/wp-content/acayganteng88.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016473; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://efecsos.com/wp-content/api.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016474; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://forextradingtruth.com/wp-includes/api.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016475; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://leviathandesign.com.au/assets/img/api.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016476; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://leviathandesign.com.au/assets/include/apiacy.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016477; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://naturesbuffet.co.in/api-lrsbaru.html?key={random_letternumberuplow_5},email={email}&post={random_number_5}_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016478; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://rdx-irsusagov.com?key=b2tiu,email=email@email.com&post=13135_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016479; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://rdx-irsusagov.com?key=jhtuf,email=email@email.com&post=05998_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016480; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://rdx-irsusagov.com?key=jhtuf,email=maxwellseard@icloud.com&post=05998_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016481; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://rdx-irsusagov.com?key=p2znu,email=carlosg918@icloud.com&post=87241_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016482; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://rdx-irsusagov.com?key=p2znu,email=email@email.com&post=87241_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016483; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://rdx-irsusagov.com?key=ppjto,email=email@email.com&post=44500_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016484; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://rdx-irsusagov.com?key=qrcv6,email=email@email.com&post=91315_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016485; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://rdx-irsusagov.com?key=uocle,email=email@email.com&post=58150_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016486; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://rdx-irsusagov.com?key=xnxyp,email=email@email.com&post=84575_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016487; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://rdx-usaprofilefederal.com?key=nfhjn,email=email@email.com&post=47493_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016488; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://rdx-usaprofilefederal.com?key=zza21,email=email@email.com&post=39704_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016489; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://solardoqueijo.com/wp-content/api.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016490; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://twitter.com?w5htjopplcko0cun0kky&cc_key=?trackingid=o9xc3cyu&signature=newsletter"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016491; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://wpcdecor.com/wp-includes/acy-ling.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016492; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://www.marmum.ae/css/?key=yihv"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016493; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://www.mathelin-teinture-tissus.com/assets/include/api.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016494; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://www.newlifenursery.com/assets/rdt.html?key=lwhi1"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016495; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://www.pawcz.cn/wp-includes/css/api.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016496; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://www.pawcz.cn/wp-includes/js/api.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016497; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/away.php?to=https://www.thaitheparos.com/assets/css/api.php?key=%7brandom_letternumberuplow_5%7d,email=%7bemail%7d&post=%7brandom_number_5%7d_1&cc_key"; http_uri; nocase; content:"vk.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016498; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/vr-banking.html"; http_uri; nocase; content:"vr-banking-app.de"; content:"Host"; http_header; classtype:attempted-recon; sid:200016499; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/tlmd/"; http_uri; nocase; content:"vu.fr"; content:"Host"; http_header; classtype:attempted-recon; sid:200016500; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8jdu/sb6/index.php?_&amp\;_"; http_uri; nocase; content:"wallieget.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016501; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/8jdu/sb6/index.php?_&amp\;_&amp\;_"; http_uri; nocase; content:"wallieget.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016502; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/o2/a/f5s4y/0"; http_uri; nocase; content:"warriorplus.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016503; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wallet/"; http_uri; nocase; content:"web.securemainappnet.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016504; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-content/themes/sketch/js/sf_trash/c45b222914e3c78d/"; http_uri; nocase; content:"webuyworkshopequipment.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016505; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/wp-content//pronto/elect/swisss/swiss/"; http_uri; nocase; content:"weitzmedicalmanagement.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016506; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/company/banco-original"; http_uri; nocase; content:"weps.org"; content:"Host"; http_header; classtype:attempted-recon; sid:200016507; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/login"; http_uri; nocase; content:"wf465online.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016508; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/@bt_home"; http_uri; nocase; content:"withkoji.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016509; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/@bt_internet"; http_uri; nocase; content:"withkoji.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016510; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/@bt_service_alert."; http_uri; nocase; content:"withkoji.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016511; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/@bt_teem"; http_uri; nocase; content:"withkoji.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016512; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/@bt_update"; http_uri; nocase; content:"withkoji.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016513; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/@bt_upgrade"; http_uri; nocase; content:"withkoji.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016514; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/@btinternet"; http_uri; nocase; content:"withkoji.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016515; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/@optunsnet"; http_uri; nocase; content:"wlo.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200016516; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/testing02"; http_uri; nocase; content:"wow.link"; content:"Host"; http_header; classtype:attempted-recon; sid:200016517; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/1658514214/pe/home"; http_uri; nocase; content:"wvw.lnterbankbenefilt.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016518; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/#test@test.com"; http_uri; nocase; content:"zi0034034323.web.app"; content:"Host"; http_header; classtype:attempted-recon; sid:200016519; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/forms/?serviceurl=/qudustemitope455/form/signinyourbtaccountcorrectly/share"; http_uri; nocase; content:"zoho.com"; content:"Host"; http_header; classtype:attempted-recon; sid:200016520; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/efrrqedv9fec#michael@.yorku.ca"; http_uri; nocase; content:"zpr.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200016521; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/kms8u47zlxwk"; http_uri; nocase; content:"zpr.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200016522; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/mxvzwlcdizyq"; http_uri; nocase; content:"zpr.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200016523; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/nckeqquhrpuf"; http_uri; nocase; content:"zpr.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200016524; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"phishing-filter phishing website detected"; flow:established,from_client; content:"GET"; http_method; content:"/uyydv5mqujps"; http_uri; nocase; content:"zpr.io"; content:"Host"; http_header; classtype:attempted-recon; sid:200016525; rev:1;)